CVE-2023-22374
Assigner: f5
Published: 2023-02-01T17:54:46.798Z
State: PUBLISHED
affected: defaultStatus: unknown
modules: All Modules
product: BIG-IP
vendor: F5
versions: changes: at: Engineering Hotfix Available
status: unaffected
lessThan: 17.1.0
status: affected
version: 17.0.0
versionType: semver
changes: at: Engineering Hotfix Available
status: unaffected
lessThan: 16.1.3.4
status: affected
version: 16.1.2.2
versionType: semver
changes: at: Engineering Hotfix Available
status: unaffected
lessThan: 15.1.8.2
status: affected
version: 15.1.5.1
versionType: semver
changes: at: Engineering Hotfix Available
status: unaffected
lessThan: 14.1.5.4
status: affected
version: 14.1.4.6
versionType: semver
changes: at: Engineering Hotfix Available
status: unaffected
lessThan: *
status: affected
version: 13.1.5
versionType: semver
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: F5 acknowledges Ron Bowes of Rapid7 for bringing this issue to our attention and following the highest standards of coordinated disclosure.
datePublic: 2023-02-01T15:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.</span>
&nbsp;Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br>


value: 
A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.
 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.



metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: Appliance Mode
problemTypes: descriptions: cweId: CWE-134
description: CWE-134 Use of Externally-Controlled Format String
type: CWE
source: discovery: EXTERNAL
title: iControl SOAP vulnerability
x_generator: engine: Vulnogram 0.1.0-dev