CVE Feed

    Dashboard / CVE / CVE-2012-1777

    CVE-2012-1777

    SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.

    Published:Apr 4, 2012
    Last Modified:Apr 11, 2025
    EPS:Apr 4, 2012
    EPSS Score:0.00983
    CVSS Score:7.5

    Affected Products

    Vendor
    F5
    Product
    Firepass

    Exploits

    https://www.sec-consult.com/files/20120328-0_F5_FirePass_SSL_VPN_unauthenticated_remote_root_v1.0.txthttps://www.sec-consult.com/files/20120328-0_F5_FirePass_SSL_VPN_unauthenticated_remote_root_v1.0.txt

    Related CVEs

    CVE-2014-2927 (CVSS 9.3) — The rsync daemon in F5 BIG-IP 11.6 before 11.6.0, 11.5.1 before HF3, 11.5.0 before HF4, 11.4.1 before HF4, 11.…
    CVE-2013-6024 (CVSS 4.4) — The Edge Client components in F5 BIG-IP APM 10.x, 11.x, 12.x, 13.x, and 14.x, BIG-IP Edge Gateway 10.x and 11.…
    CVE-2013-0150 (CVSS 9.3) — Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG…
    CVE-2013-3587 (CVSS 5.9) — The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfu…
    CVE-2012-2053 (CVSS 7.2) — The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not requi…
    CVE-2011-3188 (CVSS 9.1) — The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to gener…
    CVE-2007-0188 (CVSS 6.5) — F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single i…
    CVE-2007-0187 (CVSS 7.5) — F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing nul…
    CVE-2007-0195 (CVSS 5) — my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login…

    References

    http://packetstormsecurity.org/files/111276/F5-FirePass-SSL-VPN-6.x-7.x-SQL-Injection.html
    http://seclists.org/fulldisclosure/2012/Mar/324
    http://secunia.com/advisories/48455
    http://support.f5.com/kb/en-us/solutions/public/13000/400/sol13463.html
    http://www.securitytracker.com/id?1026834
    https://exchange.xforce.ibmcloud.com/vulnerabilities/74198
    https://exchange.xforce.ibmcloud.com/vulnerabilities/74450
    https://www.sec-consult.com/files/20120328-0_F5_FirePass_SSL_VPN_unauthenticated_remote_root_v1.0.txt
    http://packetstormsecurity.org/files/111276/F5-FirePass-SSL-VPN-6.x-7.x-SQL-Injection.html
    http://seclists.org/fulldisclosure/2012/Mar/324
    http://secunia.com/advisories/48455
    http://support.f5.com/kb/en-us/solutions/public/13000/400/sol13463.html
    http://www.securitytracker.com/id?1026834
    https://exchange.xforce.ibmcloud.com/vulnerabilities/74198
    https://exchange.xforce.ibmcloud.com/vulnerabilities/74450
    https://www.sec-consult.com/files/20120328-0_F5_FirePass_SSL_VPN_unauthenticated_remote_root_v1.0.txt

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High