CVE-2015-4637
Last modified
CVE-2015-4637 is a vulnerability of currently unknown severity. The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name.. EPSS estimates a 1.14% chance of exploitation in the next 30 days.
Description
The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and 4.5.0 before HF2 and ADC 4.5.0 before HF2, when configured for LDAP remote authentication and the LDAP server allows anonymous BIND operations, allows remote attackers to obtain an authentication token for arbitrary users by guessing an LDAP user account name.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| F5 | Big-Iq Adc | 4.5.0 |
| F5 | Big-Iq Cloud | 4.4.0 |
| F5 | Big-Iq Cloud | 4.5.0 |
| F5 | Big-Iq Device | 4.4.0 |
| F5 | Big-Iq Device | 4.5.0 |
| F5 | Big-Iq Security | 4.4.0 |
| F5 | Big-Iq Security | 4.5.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-4637?
How severe is CVE-2015-4637?
How do I fix CVE-2015-4637?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-4629Huawei E5756S before V200R002B146D23SP00C00 allows remote at…
- CVE-2015-4630Multiple cross-site request forgery (CSRF) vulnerabilities i…
- CVE-2015-4631Multiple cross-site scripting (XSS) vulnerabilities in Koha …
- CVE-2015-4632Multiple directory traversal vulnerabilities in Koha 3.14.x …
- CVE-2015-4633Multiple SQL injection vulnerabilities in Koha 3.14.x before…
- CVE-2015-4634SQL injection vulnerability in graphs.php in Cacti before 0.…
- CVE-2015-4638The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analyt…
- CVE-2015-4639Cross-site scripting (XSS) vulnerability in opac-addbybiblio…
- CVE-2015-4640The SwiftKey language-pack update implementation on Samsung …
- CVE-2015-4641Directory traversal vulnerability in the SwiftKey language-p…
- CVE-2015-4642The escapeshellarg function in ext/standard/exec.c in PHP be…
- CVE-2015-4643Integer overflow in the ftp_genlist function in ext/ftp/ftp.…
Are you affected by CVE-2015-4637?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST