CVE-2022-28714 | ByteOS Network

Vulnerability Details :

CVE-2022-28714

Assigner-f5

Assigner Org ID-9dacffd4-cb11-413f-8451-fbbfd4ddc0ab

Published At-05 May, 2022 | 16:40

Updated At-16 Sep, 2024 | 17:18

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:f5

Assigner Org ID:9dacffd4-cb11-413f-8451-fbbfd4ddc0ab

Published At:05 May, 2022 | 16:40

Updated At:16 Sep, 2024 | 17:18

▼CVE Numbering Authority (CNA)

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected Products

Vendor

Product

Versions

Affected

12.1.x
11.6.x
From 16.1.x before 16.1.2.2 (custom)
From 15.1.x before 15.1.5.1 (custom)
From 14.1.x before 14.1.4.6 (custom)
From 13.1.x before 13.1.5 (custom)

Unaffected

From 17.0.0 before 17.0.x* (custom)

Vendor

Product

BIG-IP APM Clients

Versions

Affected

From 7.x before 7.2.1.5 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-427	CWE-427 Uncontrolled Search Path Element

Type: CWE

CWE ID: CWE-427

Description: CWE-427 Uncontrolled Search Path Element

Metrics

Version	Base score	Base severity	Vector
3.1	7.3	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.3

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Credits

F5 would like to acknowledge Minki Jang of HackEnTerBoBs and Raeez Abdulla of CodeGreen Systems, UAE for bringing this issue to our attention and following the highest standards of coordinated disclosure.

References

Hyperlink	Resource
https://support.f5.com/csp/article/K54460845	x_refsource_MISC

Hyperlink: https://support.f5.com/csp/article/K54460845

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.f5.com/csp/article/K54460845	x_refsource_MISC x_transferred

Hyperlink: https://support.f5.com/csp/article/K54460845

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:f5sirt@f5.com

Published At:05 May, 2022 | 17:15

Updated At:12 May, 2022 | 15:29

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	7.3	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	4.4	MEDIUM	AV:L/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.3

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.4

Base severity: MEDIUM

Vector:

AV:L/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

>>big-ip_access_policy_manager>>11.6.1

cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>11.6.2

cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.2:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>11.6.3

cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.3:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>11.6.4

cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.4:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>11.6.5

cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.5:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.0

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.1

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.2

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.3

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.3:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.4

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.4:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.5

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.5:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>12.1.6

cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.6:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>13.1.0

cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.0:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>13.1.1

cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.1:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>13.1.3

cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.3:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>13.1.4

cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.4:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>13.1.5

cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.5:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>14.1.0

cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.0:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>14.1.2

cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.2:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>14.1.3

cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.3:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>14.1.4

cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.4:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>15.1.0

cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.0:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>15.1.1

cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.1:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>15.1.2

cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.2:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>15.1.3

cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.3:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>15.1.4

cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.4:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>15.1.5

cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.5:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>16.1.0

cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.0:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>16.1.1

cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.1:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>16.1.2

cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.2:*:*:*:*:*:*:*

>>big-ip_access_policy_manager>>17.0.0

cpe:2.3:a:f5:big-ip_access_policy_manager:17.0.0:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.5

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.5:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.6

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.6:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.6.1

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.6.1:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.7

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.7:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.8

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.8:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.8.2

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.8.2:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.1.9

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.1.9:*:*:*:*:*:*:*

>>big-ip_access_policy_manager_client>>7.2.1

cpe:2.3:a:f5:big-ip_access_policy_manager_client:7.2.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-427	Primary	f5sirt@f5.com

CWE ID: CWE-427

Type: Primary

Source: f5sirt@f5.com

References

Hyperlink	Source	Resource
https://support.f5.com/csp/article/K54460845	f5sirt@f5.com	Vendor Advisory

Hyperlink: https://support.f5.com/csp/article/K54460845

Source: f5sirt@f5.com

Resource:

Vendor Advisory