6.5

CVE-2022-41770

In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Access Policy Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Access Policy Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Analytics Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Analytics Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Analytics Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Analytics Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Application Security Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Application Security Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Application Security Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Domain Name System Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Domain Name System Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Domain Name System Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Domain Name System Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Fraud Protection Service Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Fraud Protection Service Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Fraud Protection Service Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Global Traffic Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Global Traffic Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Global Traffic Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Global Traffic Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Global Traffic Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Link Controller Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Link Controller Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Link Controller Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Link Controller Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Local Traffic Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Local Traffic Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Local Traffic Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.1.0 < 14.1.5.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 15.1.0 < 15.1.7
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 < 16.1.3.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.0.0 < 17.0.0.1
F5 ≫ Big-iq Centralized Management Version >= 8.0.0 <= 8.2.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.53% 0.663
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
f5sirt@f5.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.