Lucene search

F5CVELIST:CVE-2023-29240

HistoryMay 03, 2023 - 2:35 p.m.

CVE-2023-29240 BIG-IQ iControl REST Vulnerability

2023-05-0314:35:03

CWE-269

www.cve.org

cve-2023-29240

big-iq

icontrol rest

vulnerability

authenticated

viewer

auditor

arbitrary files

endpoint

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

17.3%

JSON

An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "Centralized Management"
    ],
    "product": "BIG-IQ",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "8.3.0",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

my.f5.com/manage/s/article/K000132719

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

17.3%

JSON

Related for CVELIST:CVE-2023-29240