CVE-2013-0150
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.
Key facts
- CVSS score
- 9.3 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-22
- EPSS score
- 6.3% (94th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2013-0193)
- Published
- August 9, 2013
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2013-0193 in the EU Vulnerability Database. Last updated in EUVD on September 16, 2024.
View on the EU Vulnerability DatabaseAffected products
- f5 / big-ip access policy manager
- f5 / big-ip advanced firewall manager
- f5 / big-ip analytics
- f5 / big-ip application security manager
- f5 / big-ip edge gateway
- f5 / big-ip global traffic manager
- f5 / big-ip link controller
- f5 / big-ip local traffic manager
- f5 / big-ip policy enforcement manager
- f5 / big-ip protocol security module
- f5 / big-ip wan optimization manager
- f5 / big-ip webaccelerator
- f5 / firepass
- f5 / firepass
References
- http://secunia.com/advisories/53477(Not Applicable, Vendor Advisory)
- http://support.f5.com/kb/en-us/solutions/public/14000/400/sol14468.html(Vendor Advisory)
- https://nealpoole.com/blog/2013/07/code-execution-via-f5-networks-java-applet/(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain