CVE-2022-23031 | ByteOS Network

Vulnerability Details :

CVE-2022-23031

Assigner-f5

Assigner Org ID-9dacffd4-cb11-413f-8451-fbbfd4ddc0ab

Published At-25 Jan, 2022 | 19:11

Updated At-03 Aug, 2024 | 03:28

On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:f5

Assigner Org ID:9dacffd4-cb11-413f-8451-fbbfd4ddc0ab

Published At:25 Jan, 2022 | 19:11

Updated At:03 Aug, 2024 | 03:28

▼CVE Numbering Authority (CNA)

On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Products

Vendor

Product

BIG-IP FPS, ASM, and Advanced WAF

Versions

Affected

16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4

Problem Types

Type	CWE ID	Description
CWE	CWE-611	CWE-611: Improper Restriction of XML External Entity Reference

Type: CWE

CWE ID: CWE-611

Description: CWE-611: Improper Restriction of XML External Entity Reference

References

Hyperlink	Resource
https://support.f5.com/csp/article/K61112120	x_refsource_MISC

Hyperlink: https://support.f5.com/csp/article/K61112120

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.f5.com/csp/article/K61112120	x_refsource_MISC x_transferred

Hyperlink: https://support.f5.com/csp/article/K61112120

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:f5sirt@f5.com

Published At:25 Jan, 2022 | 20:15

Updated At:01 Feb, 2022 | 19:11

On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 4.9

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Type: Primary

Version: 2.0

Base score: 4.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:N/A:N

CPE Matches

>>big-ip_advanced_web_application_firewall>>Versions from 14.1.0(inclusive) to 14.1.4(inclusive)

cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*

>>big-ip_advanced_web_application_firewall>>Versions from 15.1.0(inclusive) to 15.1.3(inclusive)

cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*

>>big-ip_advanced_web_application_firewall>>Versions from 16.0.0(inclusive) to 16.1.0(inclusive)

cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*

>>big-ip_application_security_manager>>Versions from 14.1.0(inclusive) to 14.1.4(inclusive)

cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*

>>big-ip_application_security_manager>>Versions from 15.1.0(inclusive) to 15.1.3(inclusive)

cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*

>>big-ip_application_security_manager>>Versions from 16.0.0(inclusive) to 16.1.0(inclusive)

cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*

>>big-ip_fraud_protection_service>>Versions from 14.1.0(inclusive) to 14.1.4(inclusive)

cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*

>>big-ip_fraud_protection_service>>Versions from 15.1.0(inclusive) to 15.1.3(inclusive)

cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*

>>big-ip_fraud_protection_service>>Versions from 16.0.0(inclusive) to 16.1.0(inclusive)

cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-611	Primary	nvd@nist.gov
CWE-611	Secondary	f5sirt@f5.com

CWE ID: CWE-611

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-611

Type: Secondary

Source: f5sirt@f5.com

References

Hyperlink	Source	Resource
https://support.f5.com/csp/article/K61112120	f5sirt@f5.com	Mitigation Vendor Advisory

Hyperlink: https://support.f5.com/csp/article/K61112120

Source: f5sirt@f5.com

Resource:

Mitigation

Vendor Advisory