CVE-2022-33203

BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

En BIG-IP versiones 16.1.x anteriores a 16.1.3, 15.1.x anteriores a 15.1.6.1 y 14.1.x anteriores a 14.1.5, cuando es configurado una política de acceso de BIG-IP APM con el agente Service Connect en un servidor virtual, las peticiones no reveladas pueden causar un aumento en el uso de los recursos de memoria. Nota: Las versiones de software que han alcanzado el fin del soporte técnico (EoTS) no son evaluadas

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-07-19 CVE Reserved
2022-08-04 CVE Published
2024-02-24 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://support.f5.com/csp/article/K52534925	2022-08-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
F5 Search vendor "F5"		Big-ip Access Policy Manager Search vendor "F5" for product "Big-ip Access Policy Manager"				>= 14.1.0 < 14.1.5 Search vendor "F5" for product "Big-ip Access Policy Manager" and version " >= 14.1.0 < 14.1.5"		-		Affected
F5 Search vendor "F5"		Big-ip Access Policy Manager Search vendor "F5" for product "Big-ip Access Policy Manager"				>= 15.1.0 < 15.1.6.1 Search vendor "F5" for product "Big-ip Access Policy Manager" and version " >= 15.1.0 < 15.1.6.1"		-		Affected
F5 Search vendor "F5"		Big-ip Access Policy Manager Search vendor "F5" for product "Big-ip Access Policy Manager"				>= 16.1.0 < 16.1.3 Search vendor "F5" for product "Big-ip Access Policy Manager" and version " >= 16.1.0 < 16.1.3"		-		Affected
F5 Search vendor "F5"		Big-ip Ssl Orchestrator Search vendor "F5" for product "Big-ip Ssl Orchestrator"				>= 14.1.0 < 14.1.5 Search vendor "F5" for product "Big-ip Ssl Orchestrator" and version " >= 14.1.0 < 14.1.5"		-		Affected
F5 Search vendor "F5"		Big-ip Ssl Orchestrator Search vendor "F5" for product "Big-ip Ssl Orchestrator"				>= 15.1.0 < 15.1.6.1 Search vendor "F5" for product "Big-ip Ssl Orchestrator" and version " >= 15.1.0 < 15.1.6.1"		-		Affected
F5 Search vendor "F5"		Big-ip Ssl Orchestrator Search vendor "F5" for product "Big-ip Ssl Orchestrator"				>= 16.1.0 < 16.1.3 Search vendor "F5" for product "Big-ip Ssl Orchestrator" and version " >= 16.1.0 < 16.1.3"		-		Affected