Vulnerability-Lookup

BDU:2023-01143 (CVE-2023-22326)

Vulnerability from fstec – Published: 2023-03-07 – Updated: 2023-11-28 – View on bdu.fstec.ru Fixed

Title

Уязвимость средства контроля доступа и удаленной аутентификации BIG-IP Access Policy Manager, а также программных средств BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Hybrid Defender, BIG-IP Domain Name System, BIG-IP Fraud Protection Service, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Orchestrator, позволяющая нарушителю получить доступ к конфиденциальным данным

Summary

Уязвимость средства контроля доступа и удаленной аутентификации BIG-IP Access Policy Manager, а также программных средств BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Hybrid Defender, BIG-IP Domain Name System, BIG-IP Fraud Protection Service, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Orchestrator, связана с ошибками обработки данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить доступ к конфиденциальным данным

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:N/A:N

4.9 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Functionality abuse

Incidents

Being clarified

Remediation

Software update

CWE

CWE-732 - Неправильное присвоение разрешений для критичного ресурса

Aliases

CVE-2023-22326

References

1 reference

URL
https://my.f5.com/manage/s/article/K83284425

Impacted products

12 products from 2 vendors

Vendors

F5 Networks, Inc.

Products

BIG-IP Advanced Firewall Manager, BIG-IP Application Security Manager, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Fraud Protection Service, BIG-IP DDos Hybrid Defender, BIG-IP SSL Orchestrator, BIG-IP Access Policy Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Domain Name System

Versions

от 13.1.0 до 13.1.5 (BIG-IP Advanced Firewall Manager), от 13.1.0 до 13.1.5 (BIG-IP Application Security Manager), от 13.1.0 до 13.1.5 (BIG-IP Link Controller), от 13.1.0 до 13.1.5 (BIG-IP Local Traffic Manager), от 13.1.0 до 13.1.5 (BIG-IP Policy Enforcement Manager), от 13.1.0 до 13.1.5 (BIG-IP Fraud Protection Service), от 13.1.0 до 13.1.5 (BIG-IP DDos Hybrid Defender), от 13.1.0 до 13.1.5 (BIG-IP SSL Orchestrator), от 13.1.0 до 13.1.5 включительно (BIG-IP Access Policy Manager), от 13.1.0 до 13.1.5 включительно (BIG-IP Analytics), от 13.1.0 до 13.1.5 включительно (BIG-IP Application Acceleration Manager), от 14.1.0 до 14.1.5.3 (BIG-IP Access Policy Manager), от 16.1.0 до 16.1.3.3 (BIG-IP Access Policy Manager), от 17.0.0 до 17.0.0.2 (BIG-IP Access Policy Manager), от 14.1.0 до 14.1.5.3 (BIG-IP Advanced Firewall Manager), от 16.1.0 до 16.1.3.3 (BIG-IP Advanced Firewall Manager), от 17.0.0 до 17.0.0.2 (BIG-IP Advanced Firewall Manager), от 14.1.0 до 14.1.5.3 (BIG-IP Analytics), от 16.1.0 до 16.1.3.3 (BIG-IP Analytics), от 17.0.0 до 17.0.0.2 (BIG-IP Analytics), от 16.1.0 до 16.1.3.3 (BIG-IP Application Acceleration Manager), от 17.0.0 до 17.0.0.2 (BIG-IP Application Acceleration Manager), от 16.1.0 до 16.1.3.3 (BIG-IP Application Security Manager), от 17.0.0 до 17.0 0.2 (BIG-IP Application Security Manager), от 14.1.0 до 14.1.5.3 (BIG-IP DDos Hybrid Defender), от 16.1.0 до 16.1.3.3 (BIG-IP DDos Hybrid Defender), от 14.1.0 до 14.1.5.3 (BIG-IP Domain Name System), от 16.1.0 до 16.1.3.3 (BIG-IP Domain Name System), от 17.0.0 до 17.0.0.2 (BIG-IP Domain Name System), от 16.1.0 до 16. 1.3.3 (BIG-IP Fraud Protection Service), от 17.0.0 до 17.0.0.2 (BIG-IP Fraud Protection Service), от 16.1.0 до 16.1.3.3 (BIG-IP Link Controller), от 17.0.0 до 17.0.0.2 (BIG-IP Link Controller), от 14.1.0 до 14.1.5.3 (BIG-IP Local Traffic Manager), от 16.1.0 до 16.1.3.3 (BIG-IP Local Traffic Manager), от 17.0.0 до 17.0.0.2 (BIG-IP Local Traffic Manager), от 14.1.0 до 14.1.5.3 (BIG-IP Policy Enforcement Manager), от 16.1.0 до 16.1.3.3 (BIG-IP Policy Enforcement Manager), от 17.0.0 до 17.0.0.2 (BIG-IP Policy Enforcement Manager), от 14.1.0 до 14.1.5.3 (BIG-IP SSL Orchestrator), от 16.1.0 до 16.1.3.3 (BIG-IP SSL Orchestrator), от 17.0.0 до 17.0.0.2 (BIG-IP SSL Orchestrator), от 14.1.0 до 14.1.5.3 (BIG-IP Application Security Manager), от 14.1.0 до 14.1.5.3 (BIG-IP Link Controller), от 15.1.0 до 15.1.8.1 (BIG-IP Access Policy Manager), от 15.1.0 до 15.1.8.1 (BIG-IP Advanced Firewall Manager), от 15.1.0 до 15.1.8.1 (BIG-IP Analytics), от 15.1.0 до 15.1.8.1 (BIG-IP Application Acceleration Manager), от 15.1.0 до 15.1.8.1 (BIG-IP Application Security Manager), от 15.1.0 до 15.1.8.1 (BIG-IP DDos Hybrid Defender), от 15.1.0 до 15.1.8.1 (BIG-IP Domain Name System), от 15.1.0 до 15.1.8.1 (BIG-IP Fraud Protection Service), от 15.1.0 до 15.1.8.1 (BIG-IP Link Controller), от 15.1.0 до 15.1.8.1 (BIG-IP Local Traffic Manager), от 15.1.0 до 15.1.8.1 (BIG-IP Policy Enforcement Manager), от 15.1.0 до 15.1.8.1 (BIG-IP SSL Orchestrator)

Product types

Network appliance software, Security device, Security software, ПО программно-аппаратных средств защиты, Network device, Network software

Mitigations

Использование рекомендаций: https://my.f5.com/manage/s/article/K83284425

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "F5 Networks, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP Advanced Firewall Manager), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP Application Security Manager), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP Link Controller), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP Local Traffic Manager), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP Policy Enforcement Manager), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP Fraud Protection Service), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP DDos Hybrid Defender), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 (BIG-IP SSL Orchestrator), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (BIG-IP Access Policy Manager), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (BIG-IP Analytics), \u043e\u0442 13.1.0 \u0434\u043e 13.1.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (BIG-IP Application Acceleration Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Access Policy Manager), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Access Policy Manager), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Access Policy Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Advanced Firewall Manager), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Advanced Firewall Manager), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Advanced Firewall Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Analytics), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Analytics), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Analytics), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Application Acceleration Manager), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Application Acceleration Manager), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Application Security Manager), \u043e\u0442 17.0.0 \u0434\u043e 17.0 0.2 (BIG-IP Application Security Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP DDos Hybrid Defender), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP DDos Hybrid Defender), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Domain Name System), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Domain Name System), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Domain Name System), \u043e\u0442 16.1.0 \u0434\u043e 16. 1.3.3 (BIG-IP Fraud Protection Service), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Fraud Protection Service), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Link Controller), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Link Controller), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Local Traffic Manager), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Local Traffic Manager), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Local Traffic Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Policy Enforcement Manager), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP Policy Enforcement Manager), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP Policy Enforcement Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP SSL Orchestrator), \u043e\u0442 16.1.0 \u0434\u043e 16.1.3.3 (BIG-IP SSL Orchestrator), \u043e\u0442 17.0.0 \u0434\u043e 17.0.0.2 (BIG-IP SSL Orchestrator), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Application Security Manager), \u043e\u0442 14.1.0 \u0434\u043e 14.1.5.3 (BIG-IP Link Controller), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Access Policy Manager), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Advanced Firewall Manager), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Analytics), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Application Acceleration Manager), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Application Security Manager), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP DDos Hybrid Defender), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Domain Name System), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Fraud Protection Service), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Link Controller), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Local Traffic Manager), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP Policy Enforcement Manager), \u043e\u0442 15.1.0 \u0434\u043e 15.1.8.1 (BIG-IP SSL Orchestrator)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://my.f5.com/manage/s/article/K83284425",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "01.02.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.03.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-01143",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-22326",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "BIG-IP Advanced Firewall Manager, BIG-IP Application Security Manager, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Fraud Protection Service, BIG-IP DDos Hybrid Defender, BIG-IP SSL Orchestrator, BIG-IP Access Policy Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Domain Name System",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 BIG-IP Access Policy Manager, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Hybrid Defender, BIG-IP Domain Name System, BIG-IP Fraud Protection Service, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Orchestrator, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430 (CWE-732)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 BIG-IP Access Policy Manager, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 BIG-IP Advanced Firewall Manager, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Hybrid Defender, BIG-IP Domain Name System, BIG-IP Fraud Protection Service, BIG-IP Link Controller, BIG-IP Local Traffic Manager, BIG-IP Policy Enforcement Manager, BIG-IP Orchestrator, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0417\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u043e\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://my.f5.com/manage/s/article/K83284425",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-732",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,9)"
}

CVE-2023-22326 (GCVE-0-2023-22326)

Vulnerability from cvelistv5 – Published: 2023-02-01 17:53 – Updated: 2025-03-26 15:59

Title

iControl REST and tmsh vulnerability

Summary

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-26 15:56 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

f5 mitre root

References

1 reference

URL	Tags
https://my.f5.com/manage/s/article/K83284425

Impacted products

2 products

Vendor	Product	Version
F5	BIG-IP	Affected: 17.0.0 , < 17.0.0.2 (semver) Affected: 16.1.0 , < 16.1.3.3 (semver) Affected: 15.1.0 , < 15.1.8.1 (semver) Affected: 14.1.0 , < 14.1.5.3 (semver) Affected: 13.1.0 , < * (semver)
F5	BIG-IQ Centralized Management	Affected: 8.0.0 , < * (semver) Affected: 7.1.0 , < * (semver)

Date Public

2023-02-01 15:00

Credits

F5 acknowledges Guillaume Goessel of Aon’s Cyber Labs for bringing this issue to our attention and following the highest standards of coordinated disclosure.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:07:06.431Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://my.f5.com/manage/s/article/K83284425"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-22326",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-26T15:56:47.550240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-26T15:59:43.461Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "All modules"
          ],
          "product": "BIG-IP",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "17.0.0.2",
              "status": "affected",
              "version": "17.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.1.3.3",
              "status": "affected",
              "version": "16.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.1.8.1",
              "status": "affected",
              "version": "15.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.1.5.3",
              "status": "affected",
              "version": "14.1.0",
              "versionType": "semver"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "13.1.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "BIG-IQ Centralized Management",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "F5 acknowledges Guillaume Goessel of Aon\u2019s Cyber Labs for bringing this issue to our attention and following the highest standards of coordinated disclosure."
        }
      ],
      "datePublic": "2023-02-01T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003c/b\u003eIn BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (\u003cb\u003etmsh\u003c/b\u003e) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\u003cbr\u003e"
            }
          ],
          "value": "In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell (tmsh) dig command which may allow an authenticated attacker with resource administrator or administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-01T17:53:45.327Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "url": "https://my.f5.com/manage/s/article/K83284425"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "iControl REST and tmsh vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2023-22326",
    "datePublished": "2023-02-01T17:53:45.327Z",
    "dateReserved": "2023-01-13T06:43:46.180Z",
    "dateUpdated": "2025-03-26T15:59:43.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.