Lucene search
HistoryOct 10, 2023 - 1:15 p.m.
CVE-2023-41373
cve-2023-41373
big-ip
directory traversal
authenticated attacker
command execution
security boundary
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.3 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
54.8%
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected configurations
Node
f5big-ip_access_policy_managerRange13.1.0–13.1.5
ORf5big-ip_access_policy_managerRange14.1.0–14.1.5.6
ORf5big-ip_access_policy_managerRange15.1.0–15.1.10.2
ORf5big-ip_access_policy_managerRange16.1.0–16.1.4.1
ORf5big-ip_access_policy_managerRange17.1.0–17.1.0.3
Node
f5big-ip_advanced_firewall_managerRange13.1.0–13.1.5
ORf5big-ip_advanced_firewall_managerRange14.1.0–14.1.5.6
ORf5big-ip_advanced_firewall_managerRange15.1.0–15.1.10.2
ORf5big-ip_advanced_firewall_managerRange16.1.0–16.1.4.1
ORf5big-ip_advanced_firewall_managerRange17.1.0–17.1.0.3
Node
f5big-ip_application_security_managerRange13.1.0–13.1.5
ORf5big-ip_application_security_managerRange14.1.0–14.1.5.6
ORf5big-ip_application_security_managerRange15.1.0–15.1.10.2
ORf5big-ip_application_security_managerRange16.1.0–16.1.4.1
ORf5big-ip_application_security_managerRange17.1.0–17.1.0.3
Node
f5big-ip_domain_name_systemRange13.1.0–13.1.5
ORf5big-ip_domain_name_systemRange14.1.0–14.1.5.6
ORf5big-ip_domain_name_systemRange15.1.0–15.1.10.2
ORf5big-ip_domain_name_systemRange16.1.0–16.1.4.1
ORf5big-ip_domain_name_systemRange17.1.0–17.1.0.3
Node
f5big-ip_local_traffic_managerRange13.1.0–13.1.5
ORf5big-ip_local_traffic_managerRange14.1.0–14.1.5.6
ORf5big-ip_local_traffic_managerRange15.1.0–15.1.10.2
ORf5big-ip_local_traffic_managerRange16.1.0–16.1.4.1
ORf5big-ip_local_traffic_managerRange17.1.0–17.1.0.3
Node
f5big-ip_advanced_web_application_firewallRange13.1.0–13.1.5
ORf5big-ip_advanced_web_application_firewallRange14.1.0–14.1.5.6
ORf5big-ip_advanced_web_application_firewallRange15.1.0–15.1.10.2
ORf5big-ip_advanced_web_application_firewallRange16.1.0–16.1.4.1
ORf5big-ip_advanced_web_application_firewallRange17.1.0–17.1.0.3
Node
f5big-ip_analyticsRange13.1.0–13.1.5
ORf5big-ip_analyticsRange14.1.0–14.1.5.6
ORf5big-ip_analyticsRange15.1.0–15.1.10.2
ORf5big-ip_analyticsRange16.1.0–16.1.4.1
ORf5big-ip_analyticsRange17.1.0–17.1.0.3
Node
f5big-ip_application_acceleration_managerRange13.1.0–13.1.5
ORf5big-ip_application_acceleration_managerRange14.1.0–14.1.5.6
ORf5big-ip_application_acceleration_managerRange15.1.0–15.1.10.2
ORf5big-ip_application_acceleration_managerRange16.1.0–16.1.4.1
ORf5big-ip_application_acceleration_managerRange17.1.0–17.1.0.3
Node
f5big-ip_application_visibility_and_reportingRange13.1.0–13.1.5
ORf5big-ip_application_visibility_and_reportingRange14.1.0–14.1.5.6
ORf5big-ip_application_visibility_and_reportingRange15.1.0–15.1.10.2
ORf5big-ip_application_visibility_and_reportingRange16.1.0–16.1.4.1
ORf5big-ip_application_visibility_and_reportingRange17.1.0–17.1.0.3
Node
f5big-ip_carrier-grade_natRange13.1.0–13.1.5
ORf5big-ip_carrier-grade_natRange14.1.0–14.1.5.6
ORf5big-ip_carrier-grade_natRange15.1.0–15.1.10.2
ORf5big-ip_carrier-grade_natRange16.1.0–16.1.4.1
ORf5big-ip_carrier-grade_natRange17.1.0–17.1.0.3
Node
f5big-ip_ddos_hybrid_defenderRange13.1.0–13.1.5
ORf5big-ip_ddos_hybrid_defenderRange14.1.0–14.1.5.6
ORf5big-ip_ddos_hybrid_defenderRange15.1.0–15.1.10.2
ORf5big-ip_ddos_hybrid_defenderRange16.1.0–16.1.4.1
ORf5big-ip_ddos_hybrid_defenderRange17.1.0–17.1.0.3
Node
f5big-ip_fraud_protection_serviceRange13.1.0–13.1.5
ORf5big-ip_fraud_protection_serviceRange14.1.0–14.1.5.6
ORf5big-ip_fraud_protection_serviceRange15.1.0–15.1.10.2
ORf5big-ip_fraud_protection_serviceRange16.1.0–16.1.4.1
ORf5big-ip_fraud_protection_serviceRange17.1.0–17.1.0.3
Node
f5big-ip_global_traffic_managerRange13.1.0–13.1.5
ORf5big-ip_global_traffic_managerRange14.1.0–14.1.5.6
ORf5big-ip_global_traffic_managerRange15.1.0–15.1.10.2
ORf5big-ip_global_traffic_managerRange16.1.0–16.1.4.1
ORf5big-ip_global_traffic_managerRange17.1.0–17.1.0.3
Node
f5big-ip_link_controllerRange13.1.0–13.1.5
ORf5big-ip_link_controllerRange14.1.0–14.1.5.6
ORf5big-ip_link_controllerRange15.1.0–15.1.10.2
ORf5big-ip_link_controllerRange16.1.0–16.1.4.1
ORf5big-ip_link_controllerRange17.1.0–17.1.0.3
Node
f5big-ip_policy_enforcement_managerRange13.1.0–13.1.5
ORf5big-ip_policy_enforcement_managerRange14.1.0–14.1.5.6
ORf5big-ip_policy_enforcement_managerRange15.1.0–15.1.10.2
ORf5big-ip_policy_enforcement_managerRange16.1.0–16.1.4.1
ORf5big-ip_policy_enforcement_managerRange17.1.0–17.1.0.3
Node
f5big-ip_ssl_orchestratorRange13.1.0–13.1.5
ORf5big-ip_ssl_orchestratorRange14.1.0–14.1.5.6
ORf5big-ip_ssl_orchestratorRange15.1.0–15.1.10.2
ORf5big-ip_ssl_orchestratorRange16.1.0–16.1.4.1
ORf5big-ip_ssl_orchestratorRange17.1.0–17.1.0.3
Node
f5big-ip_webacceleratorRange13.1.0–13.1.5
ORf5big-ip_webacceleratorRange14.1.0–14.1.5.6
ORf5big-ip_webacceleratorRange15.1.0–15.1.10.2
ORf5big-ip_webacceleratorRange16.1.0–16.1.4.1
ORf5big-ip_webacceleratorRange17.1.0–17.1.0.3
Node
f5big-ip_websafeRange13.1.0–13.1.5
ORf5big-ip_websafeRange14.1.0–14.1.5.6
ORf5big-ip_websafeRange15.1.0–15.1.10.2
ORf5big-ip_websafeRange16.1.0–16.1.4.1
ORf5big-ip_websafeRange17.1.0–17.1.0.3
CNA Affected
[
{
"defaultStatus": "unknown",
"modules": [
"All Modules"
],
"product": "BIG-IP",
"vendor": "F5",
"versions": [
{
"lessThan": "17.1.0.3",
"status": "affected",
"version": "17.1.0",
"versionType": "semver"
},
{
"lessThan": "16.1.4.1",
"status": "affected",
"version": "16.1.0",
"versionType": "semver"
},
{
"lessThan": "15.1.10.2",
"status": "affected",
"version": "15.1.0",
"versionType": "semver"
},
{
"lessThan": "14.1.5.6",
"status": "affected",
"version": "14.1.0",
"versionType": "semver"
},
{
"lessThan": "*",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
]References
Related
nvd
nvd
CVE-2023-41373
2023-10-10 13:15:21
nessus
nessus
F5 Networks BIG-IP : BIG-IP Configuration utility RCE (K000135689)
2023-10-13 00:00:00
cvelist
cvelist
CVE-2023-41373 BIG-IP Configuration Utility vulnerability
2023-10-10 12:33:42
zdi
zdi
F5 BIG-IP OS unzip Directory Traversal Remote Code Execution Vulnerability
2023-10-18 00:00:00
prion
prion
Directory traversal
2023-10-10 13:15:00
cnvd
cnvd
F5 BIG-IP Configuration Utility Directory Traversal Vulnerability
2023-10-11 00:00:00
f5
f5
K000135689 : BIG-IP Configuration utility vulnerability CVE-2023-41373
2023-10-10 00:00:00
K000137053 : Overview of F5 vulnerabilities (October 2023)
2023-10-10 00:00:00
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.3 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
54.8%
Related for CVE-2023-41373