CVSS: 4.4EPSS: 0%CPEs: 76EXPL: 0CVE-2023-45219 – BIG-IP tmsh vulnerability
https://notcve.org/view.php?id=CVE-2023-45219
Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. La vulnerabilidad de exposición a información confidencial existe en un comando de BIG-IP TMOS shell (tmsh) no divulgado que puede permitir que un atacante autenticado con privilegios de administrador de recursos vea información confidencial. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K20307245 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.7EPSS: 0%CPEs: 54EXPL: 0CVE-2023-43746 – BIG-IP Appliance mode external monitor vulnerability
https://notcve.org/view.php?id=CVE-2023-43746
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando se ejecuta en modo Appliance, un usuario autenticado al que se le haya asignado la función de Administrator puede evitar las restricciones del modo Appliance, utilizando el monitor externo BIG-IP en un sistema BIG-IP. Un exploit exitoso puede permitir al atacante cruzar un límite de seguridad. • https://my.f5.com/manage/s/article/K41072952 • CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 7.8EPSS: 0%CPEs: 78EXPL: 0CVE-2023-43611 – BIG-IP Edge Client for macOS vulnerability
https://notcve.org/view.php?id=CVE-2023-43611
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated El instalador del cliente BIG-IP Edge en macOS no sigue las mejores prácticas para elevar los privilegios durante el proceso de instalación. Esta vulnerabilidad se debe a una solución incompleta para CVE-2023-38418. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan • https://my.f5.com/manage/s/article/K000136185 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.5EPSS: 0%CPEs: 74EXPL: 0CVE-2023-43485 – BIGIP and BIG-IQ TACACS+ audit log Vulnerability
https://notcve.org/view.php?id=CVE-2023-43485
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando el reenvío de auditoría TACACS+ está configurado en el sistema BIG-IP o BIG-IQ, el secreto compartido se registra en texto plano en el audit log. Nota: Las versiones de software que han llegado al End of Technical Support (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K06110200 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.2EPSS: 0%CPEs: 76EXPL: 0CVE-2023-42768 – BIG-IP iControl REST vulnerability
https://notcve.org/view.php?id=CVE-2023-42768
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando a un usuario no administrador se le ha asignado una función de administrador a través de una solicitud iControl REST PUT y posteriormente la función del usuario se revierte a una función de no administrador a través de la utilidad de configuración, tmsh o iControl REST. El usuario no administrador de BIG-IP aún puede tener acceso al recurso de administración iControl REST PUT. • https://my.f5.com/manage/s/article/K26910459 • CWE-613: Insufficient Session Expiration •