Lucene search

[email protected]NVD:CVE-2023-22422

HistoryFeb 01, 2023 - 6:15 p.m.

CVE-2023-22422

2023-02-0118:15:11

CWE-120

[email protected]

web.nvd.nist.gov

big-ip

http profile

enforcement options

tmm

disclosure

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

33.8%

JSON

On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected configurations

NVD

Node

f5big-ip_access_policy_managerRange16.1.0–16.1.3.3

f5big-ip_access_policy_managerRange17.0.0–17.0.0.2

f5big-ip_advanced_firewall_managerRange16.1.0–16.1.3.3

f5big-ip_advanced_firewall_managerRange17.0.0–17.0.0.2

f5big-ip_analyticsRange16.1.0–16.1.3.3

f5big-ip_analyticsRange17.0.0–17.0.0.2

f5big-ip_application_acceleration_managerRange16.1.0–16.1.3.3

f5big-ip_application_acceleration_managerRange17.0.0–17.0.0.2

f5big-ip_application_security_managerRange16.1.0–16.1.3.3

f5big-ip_application_security_managerRange17.0.0–17.0.0.2

f5big-ip_ddos_hybrid_defenderRange16.1.0–16.1.3.3

f5big-ip_ddos_hybrid_defenderRange17.0.0–17.0.0.2

f5big-ip_domain_name_systemRange16.1.0–16.1.3.3

f5big-ip_domain_name_systemRange17.0.0–17.0.0.2

f5big-ip_fraud_protection_serviceRange16.1.0–16.1.3.3

f5big-ip_fraud_protection_serviceRange17.0.0–17.0.0.2

f5big-ip_link_controllerRange16.1.0–16.1.3.3

f5big-ip_link_controllerRange17.0.0–17.0.0.2

f5big-ip_local_traffic_managerRange16.1.0–16.1.3.3

f5big-ip_local_traffic_managerRange17.0.0–17.0.0.2

f5big-ip_policy_enforcement_managerRange16.1.0–16.1.3.3

f5big-ip_policy_enforcement_managerRange17.0.0–17.0.0.2

f5big-ip_ssl_orchestratorRange16.1.0–16.1.3.3

f5big-ip_ssl_orchestratorRange17.0.0–17.0.0.2

References

my.f5.com/manage/s/article/K43881487

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

33.8%

JSON

Related for NVD:CVE-2023-22422

cnvd1 cve1 prion1 nessus1 cvelist1 f52