CVE-2022-23032

published 2022-01-25

CVE-2022-23032: In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac…

Priority P4 28 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac and Windows is vulnerable to a DNS rebinding attack. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip_access_policy_manager	11.6.1 – 11.6.5	—
f5	big-ip_access_policy_manager	12.1.0 – 12.1.6	—
f5	big-ip_access_policy_manager	13.1.0 – 13.1.4	—
f5	big-ip_access_policy_manager	14.1.0 – 14.1.4	—
f5	big-ip_access_policy_manager	15.1.0 – 15.1.5	—
f5	big-ip_access_policy_manager	16.0.0 – 16.1.2	—
f5	big-ip_access_policy_manager_client	—	—
f5	big-ip_access_policy_manager_client	7.1.6 – 7.1.9	—
f5	big-ip_access_policy_manager_client	7.2.1 – 7.2.1.3	—
f5	big-ip_apm	—	—

CVSS provenance

nvd v3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-346