UpHeron
All vulnerabilities

Servers and applications

CVE-2014-6032

Multiple XML External Entity (XXE) vulnerabilities in the Configuration utility in F5 BIG-IP LTM, ASM, GTM, and Link Controller 11.0 through 11.6.0 and 10.0.0 through 10.2.4, AAM 11.4.0 through 11.6.0, ARM 11.3.0 through 11.6.0, Analytics 11.0.0 through 11.6.0, APM and Edge Gateway 11.0.0 through 11.6.0 and 10.1.0 through 10.2.4, PEM 11.3.0 through 11.6.0, PSM 11.0.0 through 11.4.1 and 10.0.0…

Severity
Medium 5.5
Published
1 Nov 2014
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.9% in the next 30 daysHigher than 87% of CVEs. EPSS by FIRST, 12 Nov 2026
Attack
Over the network · Needs a login
Attacker can
Read some data · Slow it down
CVSS vector
AV:N/AC:L/Au:S/C:P/I:N/A:P
Sources
NVD

Description

Multiple XML External Entity (XXE) vulnerabilities in the Configuration utility in F5 BIG-IP LTM, ASM, GTM, and Link Controller 11.0 through 11.6.0 and 10.0.0 through 10.2.4, AAM 11.4.0 through 11.6.0, ARM 11.3.0 through 11.6.0, Analytics 11.0.0 through 11.6.0, APM and Edge Gateway 11.0.0 through 11.6.0 and 10.1.0 through 10.2.4, PEM 11.3.0 through 11.6.0, PSM 11.0.0 through 11.4.1 and 10.0.0 through 10.2.4, and WOM 11.0.0 through 11.3.0 and 10.0.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allow remote authenticated users to read arbitrary files and cause a denial of service via a crafted request, as demonstrated using (1) viewList or (2) deal elements.

From NVD.

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_local_traffic_manager
  • Version 11.6.0
  • Version 11.5.1
  • Version 11.5.0
  • Version 11.4.1
All 17 release lines
  • Version 10.0.0
  • Version 10.1.0
  • Version 10.2.0
  • Version 10.2.1
  • Version 10.2.2
  • Version 10.2.3
  • Version 10.2.4
  • Version 11.0.0
  • Version 11.1.0
  • Version 11.2.0
  • Version 11.2.1
  • Version 11.3.0
  • Version 11.4.0
  • Version 11.4.1
  • Version 11.5.0
  • Version 11.5.1
  • Version 11.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-6032
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-6032