CVE-2023-45219

CVE-2023-45219 is a BIG-IP tmsh information disclosure vulnerability. An authenticated user with resource administrator privileges can view sensitive information via an undisclosed tmsh command. Affected versions: BIG-IP (all modules) 16.1.0–16.1.3, 15.1.0–15.1.8, 14.1.0–14.1.5. Fixes: 16.1.4 (16...

CVE-2023-45219 BIG-IP tmsh vulnerability

Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell tmsh command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support EoTS are...

CVE-2023-45219 BIG-IP tmsh vulnerability

Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell tmsh command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support EoTS are...

CVE-2023-43746 BIG-IP Appliance mode external monitor vulnerability

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which...

CVE-2023-43746

CVE-2023-43746 affects BIG-IP appliances running in Appliance mode. An authenticated Administrator can bypass Appliance mode restrictions via the BIG-IP external monitor, enabling a cross-boundary impact with a CVSSv3 of 8.7 (Network, Privileges Required: High, User Interaction: None, Confidentia...

CVE-2023-43746 BIG-IP Appliance mode external monitor vulnerability

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which...

CVE-2023-43611 BIG-IP Edge Client for macOS vulnerability

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43611

The CVE-2023-43611 entry concerns BIG-IP Edge Client for macOS privilege escalation during installation, linked to an incomplete fix for CVE-2023-38418. Affected products and components include BIG-IP APM edge client installation on macOS and the Edge Client installer. Impact is local privilege e...

CVE-2023-43611 BIG-IP Edge Client for macOS vulnerability

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43485 BIGIP and BIG-IQ TACACS+ audit log Vulnerability

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43485 BIGIP and BIG-IQ TACACS+ audit log Vulnerability

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-43485

CVE-2023-43485 describes an information disclosure in BIG-IP/BIG-IQ TACACS+ audit log forwarding where the shared secret is logged in plaintext. Connected advisories confirm impact: an authenticated attacker with auditor privileges can view the shared secret; there is no data plane exposure. Affe...

CVE-2023-42768 BIG-IP iControl REST vulnerability

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768 BIG-IP iControl REST vulnerability

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note:...

CVE-2023-42768

CVE-2023-42768 affects BIG-IP iControl REST privilege escalation. A non-admin user temporarily granted admin rights via iControl REST PUT can retain access to admin resources after reverting role, enabling control-plane access. According to F5 advisory K26910459, fixes are available: BIG-IP (all ...

CVE-2023-41964

The CVE-2023-41964 issue affects BIG-IP and BIG-IQ where two DB variables store sensitive values in plaintext (a proxy server password and a RADIUS/TACACS+ shared secret). The root cause is unencrypted storage of these values, enabling an authenticated attacker to access privileged information. R...

CVE-2023-41964 BIG-IP and BIG-IQ Database Variable vulnerability

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-41964 BIG-IP and BIG-IQ Database Variable vulnerability

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database DB variables. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-41373

CVE-2023-41373 affects F5 BIG-IP, specifically the Configuration Utility, where a directory traversal flaw can let an authenticated attacker execute commands on the BIG-IP system. In Appliance mode, successful exploitation may cross a security boundary. The vulnerability is mapped to high/severe ...

CVE-2023-41373 BIG-IP Configuration Utility vulnerability

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software...