CVE Feed

    Dashboard / CVE / CVE-2014-3220

    CVE-2014-3220

    F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/.

    Published:May 5, 2014
    Last Modified:Apr 12, 2025
    EPS:May 5, 2014
    EPSS Score:0.34634
    CVSS Score:9

    Affected Products

    Vendor
    F5
    Product
    Big-iq

    Exploits

    http://seclists.org/fulldisclosure/2014/May/11https://gist.github.com/brandonprry/2e73acd63094fa2a4f63http://seclists.org/fulldisclosure/2014/May/11https://gist.github.com/brandonprry/2e73acd63094fa2a4f63https://www.exploit-db.com/exploits/33143

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-66842 (CVSS 8.7) — BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user a…
    CVE-2026-41959 (CVSS 7.1) — Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnosti…
    CVE-2026-42406 (CVSS 8.5) — A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at …
    CVE-2026-32643 (CVSS 8.5) — A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at …
    CVE-2026-42937 (CVSS 7.1) — Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp comma…
    CVE-2026-40698 (CVSS 8.5) — A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at …
    CVE-2026-20916 (CVSS 7.2) — An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisc…
    CVE-2026-41957 (CVSS 8.7) — An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-…
    CVE-2026-41219 (CVSS 7.1) — An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attack…
    CVE-2026-41954 (CVSS 6.9) — Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell…

    References

    http://seclists.org/fulldisclosure/2014/May/10
    http://seclists.org/fulldisclosure/2014/May/11
    http://seclists.org/fulldisclosure/2014/May/16
    http://secunia.com/advisories/58440
    http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15229.html
    http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html
    http://www.exploit-db.com/exploits/33143
    http://www.securityfocus.com/bid/67191
    http://www.securityfocus.com/bid/67227
    https://gist.github.com/brandonprry/2e73acd63094fa2a4f63
    http://seclists.org/fulldisclosure/2014/May/10
    http://seclists.org/fulldisclosure/2014/May/11
    http://seclists.org/fulldisclosure/2014/May/16
    http://secunia.com/advisories/58440
    http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15229.html
    http://volatile-minds.blogspot.com/2014/05/f5-big-iq-v41020130-authenticated.html
    http://www.exploit-db.com/exploits/33143
    http://www.securityfocus.com/bid/67191
    http://www.securityfocus.com/bid/67227
    https://gist.github.com/brandonprry/2e73acd63094fa2a4f63

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High