CVSS: 4.3EPSS: 0%CPEs: 341EXPL: 0CVE-2022-1389
https://notcve.org/view.php?id=CVE-2022-1389
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This vulnerability allows an attacker to run a limited set of commands: ping, traceroute, and WOM diagnostics. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En todas las versiones de 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x y 11.6.x de F5 BIG-IP (corregida en 17.0.0), Se presenta una vulnerabilidad de tipo cross-site request forgery (CSRF) en una página no revelada de la utilidad de configuración de BIG-IP. Esta vulnerabilidad permite a un atacante ejecutar un conjunto limitado de comandos: ping, traceroute y diagnósticos WOM. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K49905324 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 97%CPEs: 66EXPL: 51CVE-2022-1388 – F5 BIG-IP Missing Authentication Vulnerability
https://notcve.org/view.php?id=CVE-2022-1388
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, versiones 15.1.x anteriores a 15.1.5.1, versiones 14.1.x anteriores a 14.1.4.6, versiones 13.1.x anteriores a 13.1.5 y todas las versiones 12.1.x y 11.6.x, las peticiones no reveladas pueden omitir la autenticación REST de iControl. Nota: las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. • https://github.com/alt3kx/CVE-2022-1388_PoC https://www.exploit-db.com/exploits/50932 https://github.com/horizon3ai/CVE-2022-1388 https://github.com/0xf4n9x/CVE-2022-1388 https://github.com/doocop/CVE-2022-1388-EXP https://github.com/ZephrFish/F5-CVE-2022-1388-Exploit https://github.com/numanturle/CVE-2022-1388 https://github.com/sherlocksecurity/CVE-2022-1388-Exploit-POC https://github.com/Al1ex/CVE-2022-1388 https://github.com/jheeree/CVE-2022-1388-checker https: • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 341EXPL: 0CVE-2022-27189
https://notcve.org/view.php?id=CVE-2022-27189
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when an Internet Content Adaptation Protocol (ICAP) profile is configured on a virtual server, undisclosed traffic can cause an increase in Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, en las versiones 15.1.x anteriores a 15.1.5.1, en las versiones 14.1.x anteriores a 14.1.4.6, en las versiones 13.1.x anteriores a 13.1.5 y en todas las versiones de 12.1.x y 11.6.x, cuando es configurado un perfil de protocolo de adaptación de contenidos de Internet (ICAP) en un servidor virtual, el tráfico no revelado puede causar un aumento en el uso de recursos de memoria del Traffic Management Microkernel (TMM). Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K16187341 • CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 7.5EPSS: 0%CPEs: 54EXPL: 0CVE-2022-26890
https://notcve.org/view.php?id=CVE-2022-26890
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP Advanced WAF, ASM y APM versiones 16.1.x anteriores a 16.1.2.1, 15.1.x anteriores a 15.1.5, 14.1.x anteriores a 14.1.4.6 y 13.1.x anteriores a 13.1. 5, cuando ASM o Advanced WAF, así como APM, están configurados en un servidor virtual, la política de ASM está configurada con Session Awareness, y la opción "Use APM Username and Session ID" está habilitada, las peticiones no reveladas pueden causar la finalización del proceso bd. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K03442392 • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 4.9EPSS: 0%CPEs: 341EXPL: 0CVE-2022-26835
https://notcve.org/view.php?id=CVE-2022-26835
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, directory traversal vulnerabilities exist in undisclosed iControl REST endpoints and TMOS Shell (tmsh) commands in F5 BIG-IP Guided Configuration, which may allow an authenticated attacker with at least resource administrator role privileges to read arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated En F5 BIG-IP versiones 16.1.x anteriores a 16.1.2.2, las versiones 15.1.x anteriores a 15.1.5.1, las versiones 14.1.x anteriores a 14.1.4.6, las versiones 13.1.x anteriores a 13.1.5 y todas las versiones de 12.1.x y 11.6 x, se presentan vulnerabilidades de salto de directorio en los endpoints REST de iControl no revelados y en los comandos TMOS Shell (tmsh) en F5 BIG-IP Guided Configuration, que pueden permitir a un atacante autenticado con privilegios de rol de administrador de recursos, como mínimo, leer archivos arbitrarios. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K53197140 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •