Lucene search
HistoryOct 10, 2023 - 1:15 p.m.
CVE-2023-42768
non-admin
icontrol rest
admin access
role change
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
6.9
Confidence
High
EPSS
0.001
Percentile
25.6%
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user’s role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected configurations
Node
f5big-ip_access_policy_managerRange13.1.0–13.1.5
ORf5big-ip_access_policy_managerRange14.1.0–14.1.5
ORf5big-ip_access_policy_managerRange15.1.0–15.1.9
ORf5big-ip_access_policy_managerRange16.1.0–16.1.4
ORf5big-ip_advanced_firewall_managerRange13.1.0–13.1.5
ORf5big-ip_advanced_firewall_managerRange14.1.0–14.1.5
ORf5big-ip_advanced_firewall_managerRange15.1.0–15.1.9
ORf5big-ip_advanced_firewall_managerRange16.1.0–16.1.4
ORf5big-ip_advanced_web_application_firewallRange13.1.0–13.1.5
ORf5big-ip_advanced_web_application_firewallRange14.1.0–14.1.5
ORf5big-ip_advanced_web_application_firewallRange15.1.0–15.1.9
ORf5big-ip_advanced_web_application_firewallRange16.1.0–16.1.4
ORf5big-ip_analyticsRange13.1.0–13.1.5
ORf5big-ip_analyticsRange14.1.0–14.1.5
ORf5big-ip_analyticsRange15.1.0–15.1.9
ORf5big-ip_analyticsRange16.1.0–16.1.4
ORf5big-ip_application_acceleration_managerRange13.1.0–13.1.5
ORf5big-ip_application_acceleration_managerRange14.1.0–14.1.5
ORf5big-ip_application_acceleration_managerRange15.1.0–15.1.9
ORf5big-ip_application_acceleration_managerRange16.1.0–16.1.4
ORf5big-ip_application_security_managerRange13.1.0–13.1.5
ORf5big-ip_application_security_managerRange14.1.0–14.1.5
ORf5big-ip_application_security_managerRange15.1.0–15.1.9
ORf5big-ip_application_security_managerRange16.1.0–16.1.4
ORf5big-ip_application_visibility_and_reportingRange13.1.0–13.1.5
ORf5big-ip_application_visibility_and_reportingRange14.1.0–14.1.5
ORf5big-ip_application_visibility_and_reportingRange15.1.0–15.1.9
ORf5big-ip_application_visibility_and_reportingRange16.1.0–16.1.4
ORf5big-ip_carrier-grade_natRange13.1.0–13.1.5
ORf5big-ip_carrier-grade_natRange14.1.0–14.1.5
ORf5big-ip_carrier-grade_natRange15.1.0–15.1.9
ORf5big-ip_carrier-grade_natRange16.1.0–16.1.4
ORf5big-ip_ddos_hybrid_defenderRange13.1.0–13.1.5
ORf5big-ip_ddos_hybrid_defenderRange14.1.0–14.1.5
ORf5big-ip_ddos_hybrid_defenderRange15.1.0–15.1.9
ORf5big-ip_ddos_hybrid_defenderRange16.1.0–16.1.4
ORf5big-ip_domain_name_systemRange13.1.0–13.1.5
ORf5big-ip_domain_name_systemRange14.1.0–14.1.5
ORf5big-ip_domain_name_systemRange15.1.0–15.1.9
ORf5big-ip_domain_name_systemRange16.1.0–16.1.4
ORf5big-ip_edge_gatewayRange13.1.0–13.1.5
ORf5big-ip_edge_gatewayRange14.1.0–14.1.5
ORf5big-ip_edge_gatewayRange15.1.0–15.1.9
ORf5big-ip_edge_gatewayRange16.1.0–16.1.4
ORf5big-ip_fraud_protection_serviceRange13.1.0–13.1.5
ORf5big-ip_fraud_protection_serviceRange14.1.0–14.1.5
ORf5big-ip_fraud_protection_serviceRange15.1.0–15.1.9
ORf5big-ip_fraud_protection_serviceRange16.1.0–16.1.4
ORf5big-ip_global_traffic_managerRange13.1.0–13.1.5
ORf5big-ip_global_traffic_managerRange14.1.0–14.1.5
ORf5big-ip_global_traffic_managerRange15.1.0–15.1.9
ORf5big-ip_global_traffic_managerRange16.1.0–16.1.4
ORf5big-ip_link_controllerRange13.1.0–13.1.5
ORf5big-ip_link_controllerRange14.1.0–14.1.5
ORf5big-ip_link_controllerRange15.1.0–15.1.9
ORf5big-ip_link_controllerRange16.1.0–16.1.4
ORf5big-ip_local_traffic_managerRange13.1.0–13.1.5
ORf5big-ip_local_traffic_managerRange14.1.0–14.1.5
ORf5big-ip_local_traffic_managerRange15.1.0–15.1.9
ORf5big-ip_local_traffic_managerRange16.1.0–16.1.4
ORf5big-ip_policy_enforcement_managerRange13.1.0–13.1.5
ORf5big-ip_policy_enforcement_managerRange14.1.0–14.1.5
ORf5big-ip_policy_enforcement_managerRange15.1.0–15.1.9
ORf5big-ip_policy_enforcement_managerRange16.1.0–16.1.4
ORf5big-ip_ssl_orchestratorRange13.1.0–13.1.5
ORf5big-ip_ssl_orchestratorRange14.1.0–14.1.5
ORf5big-ip_ssl_orchestratorRange15.1.0–15.1.9
ORf5big-ip_ssl_orchestratorRange16.1.0–16.1.4
ORf5big-ip_webacceleratorRange13.1.0–13.1.5
ORf5big-ip_webacceleratorRange14.1.0–14.1.5
ORf5big-ip_webacceleratorRange15.1.0–15.1.9
ORf5big-ip_webacceleratorRange16.1.0–16.1.4
ORf5big-ip_websafeRange13.1.0–13.1.5
ORf5big-ip_websafeRange14.1.0–14.1.5
ORf5big-ip_websafeRange15.1.0–15.1.9
ORf5big-ip_websafeRange16.1.0–16.1.4
| Vendor | Product | Version | CPE |
|---|---|---|---|
| f5 | big-ip_access_policy_manager | * | cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* |
| f5 | big-ip_advanced_firewall_manager | * | cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* |
| f5 | big-ip_advanced_web_application_firewall | * | cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* |
| f5 | big-ip_analytics | * | cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* |
| f5 | big-ip_application_acceleration_manager | * | cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* |
| f5 | big-ip_application_security_manager | * | cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* |
| f5 | big-ip_application_visibility_and_reporting | * | cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* |
| f5 | big-ip_carrier-grade_nat | * | cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* |
| f5 | big-ip_ddos_hybrid_defender | * | cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* |
| f5 | big-ip_domain_name_system | * | cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* |
References
Related
prion
prion
Cross site request forgery (csrf)
2023-10-10 13:15:00
vulnrichment
vulnrichment
CVE-2023-42768 BIG-IP iControl REST vulnerability
2023-10-10 12:34:06
cve
cve
CVE-2023-42768
2023-10-10 13:15:21
nessus
nessus
F5 Networks BIG-IP : BIG-IP iControl REST Privilege Escalation (K26910459)
2023-10-13 00:00:00
cnvd
cnvd
F5 BIG-IP iControl Security Bypass Vulnerability
2023-10-11 00:00:00
f5
f5
K26910459 : BIG-IP iControl REST vulnerability CVE-2023-42768
2023-10-10 00:00:00
K000137053 : Overview of F5 vulnerabilities (October 2023)
2023-10-10 00:00:00
cvelist
cvelist
CVE-2023-42768 BIG-IP iControl REST vulnerability
2023-10-10 12:34:06
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
6.9
Confidence
High
EPSS
0.001
Percentile
25.6%
Related for NVD:CVE-2023-42768