Unscored severity · published Sep 17, 2015
CVE-2015-4040
Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access…
–
CVSS
6.8%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the configuration utility in F5 BIG-IP before 12.0.0 and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to access arbitrary files in the web root via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.8% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Big-ip Access Policy Manager · F5
through 11.6.0 · source: NVD
BA
Big-ip Advanced Firewall Manager · F5
through 11.6.0 · source: NVD
BA
Big-ip Analytics · F5
through 11.6.0 · source: NVD
BA
Big-ip Application Acceleration Manager · F5
through 11.6.0 · source: NVD
BA
Big-ip Application Security Manager · F5
through 11.6.0 · source: NVD
BE
Big-ip Edge Gateway · F5
through 11.3.0 · source: NVD
BG
Big-ip Global Traffic Manager · F5
through 11.3.0 · source: NVD
BL
Big-ip Link Controller · F5
through 11.3.0 · source: NVD
BL
Big-ip Local Traffic Manager · F5
through 11.6.0 · source: NVD
BP
Big-ip Policy Enforcement Manager · F5
through 11.3.0 · source: NVD
BP
Big-ip Protocol Security Module · F5
through 11.3.0 · source: NVD
BW
Big-ip Wan Optimization Manager · F5
through 11.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4040
packetstormsecurity.com
http://packetstormsecurity.com/files/133931/F5-BigIP-10.2.4-Build-595.0-HF3-Path-Traversal.html
www.securitytracker.com
http://www.securitytracker.com/id/1033532
www.securitytracker.com
http://www.securitytracker.com/id/1033533
Vendor Advisory
https://support.f5.com/kb/en-us/solutions/public/17000/200/sol17253.html
More from Big-ip Access Policy Manager
9.8
CVE-2026-94127
BIG-IP APM OAuth vulnerability
9.8
CVE-2025-53521
BigIP APM Vulnerability
9.8
CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
9.8
CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
9.8
CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow