DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
F5 BIG-IP: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-02-01
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um seine Privilegien zu erhöhen, Code zur Ausführung zu bringen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen und einen Denial of Service zu verursachen.
01
beschreibt (16)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-23555US | high7.5 | — | ||
On BIG-IP Virtual Edition versions 15.1x beginning in 15.1.4 to before 15.1.8 and 14.1.x beginning in 14.1.5 to before 14.1.5.3, and BIG-IP SPK beginning in 1.5.0 to before 1.6.0,… | ||||
| CVE-2023-23552US | high7.5 | — | ||
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM secur… | ||||
| CVE-2023-22842US | high7.5 | — | ||
On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type vi… | ||||
| CVE-2023-22839US | high7.5 | — | ||
On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Resp… | ||||
| CVE-2023-22664US | high7.5 | — | ||
On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are… | ||||
| CVE-2023-22422US | high7.5 | — | ||
On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: R… | ||||
| CVE-2023-22418US | medium6.1 | — | ||
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtu… | ||||
| CVE-2023-22374US | — | — | ||
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appli… | ||||
| CVE-2023-22358US | high7.8 | — | ||
In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached En… | ||||
| CVE-2023-22341US | high7.5 | — | ||
On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic… | ||||
| CVE-2023-22340US | high7.5 | — | ||
On BIG-IP versions 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a SIP profile is configured on a Message Routing type virt… | ||||
| CVE-2023-22326US | medium4.9 | — | ||
In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.… | ||||
| CVE-2023-22323US | high7.5 | — | ||
In BIP-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when OCSP authentication profile is c… | ||||
| CVE-2023-22302US | medium5.9 | — | ||
In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the att… | ||||
| CVE-2023-22283US | — | — | ||
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are req… | ||||
| CVE-2023-22281US | high7.5 | — | ||
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destinatio… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
- F5 Security Advisory vom 2023-02-01external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan