Lucene search

F5VULNRICHMENT:CVE-2024-39778

HistoryAug 14, 2024 - 2:32 p.m.

CVE-2024-39778 BIG-IP HSB vulnerability

2024-08-1414:32:31

CWE-702

github.com

cve-2024-39778

big-ip

high-speed bridge

tmm termination

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

17.7%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CNA Affected

[
  {
    "vendor": "F5",
    "modules": [
      "All Modules"
    ],
    "product": "BIG-IP",
    "versions": [
      {
        "status": "affected",
        "version": "17.1.0",
        "lessThan": "17.1.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "16.1.0",
        "lessThan": "16.1.5",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "15.1.0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:f5:big_ip:*:*:*:*:*:*:*:*"
    ],
    "vendor": "f5",
    "product": "big_ip",
    "versions": [
      {
        "status": "affected",
        "version": "17.1.0",
        "lessThan": "17.1.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "16.1.0",
        "lessThan": "16.1.5",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "15.1.0",
        "versionType": "custom",
        "lessThanOrEqual": "*"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

my.f5.com/manage/s/article/K05710614

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:L

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

17.7%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-39778