CVE-2012-3000: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in sam/admin/reports/php/saveSettings.php in the (1) APM WebGUI in F5 BIG-IP LTM, GTM, ASM, Link Controller, PSM, APM, Edge Gateway, and Analytics and (2) AVR WebGUI in WebAccelerator and WOM 11.2.x before 11.2.0-HF3 and 11.2.x before 11.2.1-HF3 allow remote authenticated users to execute arbitrary SQL commands via the defaultQuery parameter.

Affected products

F5 BIG-IP Access Policy Manager: version 11.1.0 only; version 11.2.0 only; version 11.2.1 only; version 11.0.0 only
F5 BIG-IP Analytics: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Application Security Manager: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Edge Gateway: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Global Traffic Manager: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Link Controller: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Local Traffic Manager: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Protocol Security Module: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP WAN Optimization Manager: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only
F5 BIG-IP Webaccelerator: version 11.0.0 only; version 11.1.0 only; version 11.2.0 only; version 11.2.1 only

Published 2014-01-30. Last modified 2026-06-16.