CVE-2022-33947

CWE-502 — Deserialization of Untrusted Data4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.8%
top 25.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
F5 Big-ip DNSF5 Big-ip Domain Name System
Timeline
PublishedAug 4
Latest updateAug 5

Description

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with at least operator role privileges to cause the Tomcat process to restart and perform unauthorized DNS requests and operations through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5f5/big-ip_dns13.1.0 — 13.1.x*+3
▶NVDf5/big-ip_domain_name_system14.1.0 — 14.1.5+3

🔴Vulnerability Details

2
GHSA
GHSA-phrv-v8gj-645h: In BIG-IP Versions 16↗2022-08-05
▶
CVEList
BIG-IP DNS TMUI Vulnerability CVE-2022-33947↗2022-08-04
▶

📋Vendor Advisories

1
F5
CVE-2022-33947: In BIG-IP Versions 16↗2022-08-04
▶
CVE-2022-33947 (MEDIUM CVSS 6.5) | In BIG-IP Versions 16.1.x before 16 | cvebase.io