Em resumo
- CVE-2022-1388 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta big-ip access policy manager (f5), big-ip advanced firewall manager (f5), big-ip analytics (f5).
- Explorada ativamente: a CISA a adicionou ao catálogo KEV em 10/05/2022.
- Chance de exploração nos próximos 30 dias (EPSS): 100.0%, maior que 100.0% das vulnerabilidades.
- Correção: atualize para 13.1.5, 14.1.4.6, 15.1.5.1, 16.1.2.2 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| big-ip access policy manager | ≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.5≥ 14.1.0, < 14.1.4.6≥ 15.1.0, < 15.1.5.1≥ 16.1.0, < 16.1.2.2
| 13.1.514.1.4.615.1.5.116.1.2.2
|
| big-ip advanced firewall manager | ≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.5≥ 14.1.0, < 14.1.4.6≥ 15.1.0, < 15.1.5.1≥ 16.1.0, < 16.1.2.2
| 13.1.514.1.4.615.1.5.116.1.2.2
|
| big-ip analytics | ≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.5≥ 14.1.0, < 14.1.4.6≥ 15.1.0, < 15.1.5.1≥ 16.1.0, < 16.1.2.2
| 13.1.514.1.4.615.1.5.116.1.2.2
|
| big-ip application acceleration manager | ≥ 11.6.1, ≤ 11.6.5≥ 12.1.0, ≤ 12.1.6≥ 13.1.0, < 13.1.5≥ 14.1.0, < 14.1.4.6≥ 15.1.0, < 15.1.5.1
|
Description
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Mais vulnerabilidades de big-ip access policy manager
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free