6.7

CVE-2022-33962

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Data is provided by the National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Access Policy Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Access Policy Manager Version17.0.0
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Analytics Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Analytics Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Analytics Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Analytics Version17.0.0
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Application Security Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Application Security Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Domain Name System Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Domain Name System Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Domain Name System Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Domain Name System Version17.0.0
F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Fraud Protection Service Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Fraud Protection Service Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Global Traffic Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Global Traffic Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Global Traffic Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Global Traffic Manager Version17.0.0
F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Link Controller Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Link Controller Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Link Controller Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Link Controller Version17.0.0
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Local Traffic Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Local Traffic Manager Version17.0.0
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 15.1.0 < 15.1.6.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 < 16.1.3.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.212
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
f5sirt@f5.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.