In breve
- CVE-2023-46748 è una vulnerabilità ALTO (CVSS 8.8) che riguarda big-ip access policy manager (f5), big-ip advanced firewall manager (f5), big-ip advanced web application firewall (f5).
- Sfruttata attivamente: la CISA l'ha aggiunta al catalogo KEV il 31/10/2023.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.3%, superiore al 91.1% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| big-ip access policy manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1
| No fix yet |
| big-ip advanced firewall manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1
| No fix yet |
| big-ip advanced web application firewall | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1
| No fix yet |
| big-ip analytics | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5≥ 15.1.0, ≤ 15.1.10≥ 16.1.0, ≤ 16.1.4≥ 17.1.0, ≤ 17.1.1
| No fix yet |
| big-ip application acceleration manager | ≥ 13.1.0, ≤ 13.1.5≥ 14.1.0, ≤ 14.1.5
|
Description
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which
may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Altre vulnerabilità di big-ip access policy manager
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free