4.9

CVE-2023-22326

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Data is provided by the National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Access Policy Manager Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Access Policy Manager Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Access Policy Manager Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Advanced Firewall Manager Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Advanced Firewall Manager Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Advanced Firewall Manager Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Analytics Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Analytics Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Analytics Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Analytics Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Analytics Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Application Acceleration Manager Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Application Acceleration Manager Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Application Security Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Application Security Manager Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Application Security Manager Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Application Security Manager Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Application Security Manager Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Ddos Hybrid Defender Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Domain Name System Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Domain Name System Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Domain Name System Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Domain Name System Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Fraud Protection Service Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Fraud Protection Service Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Fraud Protection Service Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Fraud Protection Service Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Link Controller Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Link Controller Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Link Controller Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Link Controller Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Link Controller Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Local Traffic Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Local Traffic Manager Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Local Traffic Manager Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Local Traffic Manager Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Local Traffic Manager Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Policy Enforcement Manager Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Policy Enforcement Manager Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Policy Enforcement Manager Version >= 17.0.0 < 17.0.0.2
F5 ≫ Big-ip Ssl Orchestrator Version >= 13.1.0 <= 13.1.5
F5 ≫ Big-ip Ssl Orchestrator Version >= 14.1.0 < 14.1.5.3
F5 ≫ Big-ip Ssl Orchestrator Version >= 15.1.0 < 15.1.8.1
F5 ≫ Big-ip Ssl Orchestrator Version >= 16.1.0 < 16.1.3.3
F5 ≫ Big-ip Ssl Orchestrator Version >= 17.0.0 < 17.0.0.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.18% 0.362
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
f5sirt@f5.com 4.9 1.2 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.