Vulnerability Note VU#210884
F5 ARX Data Manager contains a SQL injection vulnerability
Original Release date: 17 Jun 2014 | Last revised: 17 Jun 2014
F5 ARX Data Manager 3.0.0 – 3.1.0 contains a SQL injection vulnerability.
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
F5 ARX Data Manager 3.0.0 – 3.1.0 contains an unspecified SQL injection vulnerability.
A remote authenticated attacker may be able to run arbitrary SQL commands against the backend database.
The CERT/CC is currently unaware of a practical solution to this problem. Data Manager 3.x is considered end-of-life by the vendor and will not receive a security fix.
Stop the Service
F5 recommends stopping the Data Manager Service when not in use to mitigate this vulnerability. F5’s SOL15310 document explains how to disable the service.
Vendor Information (Learn More)
VendorStatusDate NotifiedDate UpdatedF5 Networks, Inc.Affected14 May 201417 Jun 2014If you are a vendor and your product is affected, let
CVSS Metrics (Learn More)
Thanks to Andrea Micalizzi (rgod) working with HP’s Zero Day Initiative for reporting this vulnerability to F5.
This document was written by Jared Allar.
06 Jun 2014
Date First Published:
17 Jun 2014
Date Last Updated:
17 Jun 2014
FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.