In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| F5os-a | F5 | 1.0.0 (including) | 1.1.0 (excluding) |
| F5os-c | F5 | 1.3.0 (excluding) | 1.5.0 (excluding) |