CVE-2022-23009 — Incorrect Authorization in F5 Big-iq Centralized Management

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.3%
top 45.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
F5 Big-iq Centralized Management
Timeline
PublishedJan 25
Latest updateJan 26

Description

On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5f5/big-iq_centralized_management8.x before 8.1.0

🔴Vulnerability Details

2
GHSA
GHSA-3jr5-px2c-8j7c: On BIG-IQ Centralized Management 8↗2022-01-26
▶
CVEList
CVE-2022-23009: On BIG-IQ Centralized Management 8↗2022-01-25
▶

📋Vendor Advisories

1
F5
CVE-2022-23009: On BIG-IQ Centralized Management 8↗2022-01-25
▶
CVE-2022-23009 — Incorrect Authorization in F5 | cvebase