Vulnerabilities fixed in several F5 products

🗓️ 04 May 2023 00:00:00Reported by NCSCType

ncsc

ncsc🔗 advisories.ncsc.nl👁 4 Views

F5 fixes Big IP and Nginx vulnerabilities enabling DOS, XSS, and file access via management tools.

Reporter	Title	Published	Views	Family All 72
BDU FSTEC	The vulnerabilities of the NGINX Instance Manager automation platform, the NGINX API Connectivity Manager connection management controller, and the NGINX Security Monitoring security monitoring and management platform are related to the improper use of standard permissions. This allows attackers to increase their privileges.	17 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of the NGINX Instance Manager automation platform, the NGINX API Connectivity Manager connection management controller, and the NGINX Security Monitoring security monitoring platform involve exploiting authentication bypasses through the use of user-controlled keys. This allows attackers to circumvent security restrictions and gain access to read, modify, or delete data.	17 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Traffic Management User Interface (TMUI) of the BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Hybrid Defender, and BIG-IP Domain Name System programs allows attackers to execute cross-site scripting attacks.	19 May 202300:00	–	bdu_fstec
Circl	CVE-2023-29240	18 Sep 202520:47	–	circl
CNNVD	F5 BIG-IQ 代码问题漏洞	3 May 202300:00	–	cnnvd
CNNVD	F5 BIG-IP 安全漏洞	3 May 202300:00	–	cnnvd
CNNVD	F5 BIG-IP 安全漏洞	3 May 202300:00	–	cnnvd
CNNVD	F5 BIG-IP 安全漏洞	3 May 202300:00	–	cnnvd
CNNVD	F5 BIG-IP 路径遍历漏洞	3 May 202300:00	–	cnnvd
CNNVD	F5 BIG-IP 跨站脚本漏洞	3 May 202300:00	–	cnnvd

04 May 2023 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.1

EPSS0.01187

SSVC

Big IP vulnerabilities Nginx vulnerabilities denial of service cross site scripting directory traversal file access management suite api connectivity manager