CVE-2023-23552 BIG-IP Advanced WAF and ASM vulnerability

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource...

CVE-2023-23552

CVE-2023-23552 affects BIG-IP Advanced WAF (AWAF) and ASM when configured on a virtual server; undisclosed requests can cause memory resource utilization leading to potential DoS. Affected: 17.0.x < 17.0.0.2, 16.1.x < 16.1.3.3, 15.1.0 < 15.1.8, 14.1.x

K000130496: Overview of F5 vulnerabilities (February 2023)

Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...

PT-2023-19034 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 13.1.x F5 BIG-IP versions 14.1.x through 14.1.5.3 F5 BIG-IP versions 15.1.0 through 15.1.8 F5 BIG-IP versions 16.1.x through 16.1.3.3 F5 BIG-IP versions 17.0.x through 17.0.0.2 Description: When a BIG-IP Advanced WAF or...

K52322100: Authenticated F5 BIG-IP Guided Configuration integrity check in Appliance mode vulnerability CVE-2022-25946

Security Advisory Description When running in Appliance mode, an authenticated attacker with Administrator role privileges may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. CVE-2022-25946 Impact In Appliance mode, an authenticate...

K08402414: BIG-IP ASM and Advanced WAF REST API endpoint vulnerability CVE-2022-23026

Security Advisory Description An authenticated user with low privileges, such as a guest, can upload data using an undisclosed REST endpoint causing an increase in disk resource utilization. CVE-2022-23026 Impact An authenticated user with low privileges, such as a guest, may exploit this...

Vulnerabilities fixed in several F5 products

F5 has fixed several vulnerabilities in BIG-IP and NGINX. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution...

Remote code execution

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface...

CVE-2022-41836 BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41836 BIG-IP Advanced WAF and ASM bd vulnerability CVE-2022-41836

When an 'Attack Signature False Positive Mode' enabled security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41691 BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41691 BIG-IP Advanced WAF/ASM bd vulnerability CVE-2022-41691

When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate...

CVE-2022-41691

CVE-2022-41691 – Summary (F5 BIG-IP Advanced WAF/ASM) A vulnerability in BIG-IP Advanced WAF/ASM is triggered when a security policy is applied on a virtual server; undisclosed requests can cause the bd process to terminate, resulting in DoS on the BIG-IP system. The vulnerability is documented b...

CVE-2022-41617 BIG-IP Advanced WAF and ASM iControl REST vulnerability CVE-2022-41617

In versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and 13.1.x before 13.1.5.1, When the Advanced WAF / ASM module is provisioned, an authenticated remote code execution vulnerability exists in the BIG-IP iControl REST interface...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM bd vulnerability (K02694732)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5.2. It is, therefore, affected by a vulnerability as referenced in the K02694732 advisory. - When a BIG-IP Advanced WAF/ASM security policy is configured on a virtual server, undisclosed requests can cause the bd...

PT-2022-25987 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP versions 13.1.x through 13.1.5.1 BIG-IP versions 14.1.x through 14.1.5.1 BIG-IP versions 15.1.x through 15.1.6.1 BIG-IP versions 16.1.x through 16.1.3.1 Description: An authenticated remote code execution issue exists in the BIG-IP...

F5 Networks BIG-IP : BIG-IP Advanced WAF and ASM bd vulnerability (K47204506)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.7 / 16.1.3.1 / 17.0.0.1 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K47204506 advisory. - When an 'Attack Signature False Positive Mode' enabled security policy is configured on a...

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

CVE-2022-26890

On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Sessi...

Code injection

On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a virtual server is configured with HTTP, TCP on one side client/server, and DTLS on the other...