Unscored severity · published Aug 9, 2013
CVE-2013-0150
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass…
–
CVSS
6.3%
EPSS
No
On KEV
Description
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Big-ip Access Policy Manager · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BA
Big-ip Advanced Firewall Manager · F5
11.3.0 · source: NVD
BA
Big-ip Analytics · F5
11.0.0 through 11.3.0 · source: NVD
BA
Big-ip Application Security Manager · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BE
Big-ip Edge Gateway · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BG
Big-ip Global Traffic Manager · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BL
Big-ip Link Controller · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BL
Big-ip Local Traffic Manager · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BP
Big-ip Policy Enforcement Manager · F5
11.3.0 · source: NVD
BP
Big-ip Protocol Security Module · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BW
Big-ip Wan Optimization Manager · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
BW
Big-ip Webaccelerator · F5
10.1.0 through 10.2.4; 11.0.0 through 11.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0150
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0150
Not Applicable
http://secunia.com/advisories/53477
Vendor Advisory
http://support.f5.com/kb/en-us/solutions/public/14000/400/sol14468.html
Third Party Advisory
https://nealpoole.com/blog/2013/07/code-execution-via-f5-networks-java-applet/
More from Big-ip Access Policy Manager
9.8
CVE-2026-94127
BIG-IP APM OAuth vulnerability
9.8
CVE-2025-53521
BigIP APM Vulnerability
9.8
CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
9.8
CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
9.8
CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow