CVE-2022-23031

published 2022-01-25

CVE-2022-23031: On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE)…

Priority P4 27 medium 4.9 CVSS 3.1

AV N AC L PR H UI N S U C H I N A N

On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip_advanced_waf	—	—
f5	big-ip_advanced_web_application_firewall	14.1.0 – 14.1.4	—
f5	big-ip_advanced_web_application_firewall	15.1.0 – 15.1.3	—
f5	big-ip_advanced_web_application_firewall	16.0.0 – 16.1.0	—
f5	big-ip_application_security_manager	14.1.0 – 14.1.4	—
f5	big-ip_application_security_manager	15.1.0 – 15.1.3	—
f5	big-ip_application_security_manager	16.0.0 – 16.1.0	—
f5	big-ip_asm	—	—
f5	big-ip_fps	—	—
f5	big-ip_fraud_protection_service	14.1.0 – 14.1.4	—
f5	big-ip_fraud_protection_service	15.1.0 – 15.1.3	—
f5	big-ip_fraud_protection_service	16.0.0 – 16.1.0	—

CVSS provenance

nvd v3.1 4.9 MEDIUM CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611