DeutschShown in its original language — a full translation is planned for a future version.
F5 BIG-IP: Mehrere Schwachstellen
view advisory published 2024-02-14
Ein Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, beliebigen Code auszuführen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-24775US | high7.5 | — | ||
When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Softwa… | ||||
| CVE-2024-23982US | high7.5 | — | ||
When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue… | ||||
| CVE-2024-23979US | high7.5 | — | ||
When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual server, undisclosed requests can cause… | ||||
| CVE-2024-23976US | medium6.0 | — | ||
When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance
mode restrictions utilizing iAppsLX templates on a BIG-IP… | ||||
| CVE-2024-23805US | high7.5 | — | ||
Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. For the Application Visibility and Reporting module, this may occur when the HTTP Analytics p… | ||||
| CVE-2024-23603US | low3.8 | — | ||
An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
Note: Software versions which have reached End of Technical Support (EoTS) a… | ||||
| CVE-2024-23314US | high7.5 | — | ||
When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions whic… | ||||
| CVE-2024-23308US | high7.5 | — | ||
When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. Th… | ||||
| CVE-2024-23306US | high7.1 | — | ||
A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Note: Software versions which have reached End of Technical Support… | ||||
| CVE-2024-22389US | high7.2 | — | ||
When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device.
Note: Software versions which have rea… | ||||
| CVE-2024-22093US | high8.7 | — | ||
When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploi… | ||||
| CVE-2024-21849US | high7.5 | — | ||
When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) proc… | ||||
| CVE-2024-21789US | high7.5 | — | ||
When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.
Note: Software vers… | ||||
| CVE-2024-21782US | medium6.7 | — | ||
BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbit… | ||||
| CVE-2024-21771US | high7.5 | — | ||
For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resulting in Traffic Management Microkernel… | ||||
| CVE-2024-21763US | high7.5 | — | ||
When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queries can cause the Traffic Management Microkernel (TMM)… | ||||
02
references
External citations — patches, advisories, analysis.
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
- F5 Security Advisory vom 2024-02-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan