CVE-2022-35243
published 2022-08-04CVE-2022-35243: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an…
PriorityP350critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.63%
46.0th percentile
In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
60 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip | >= 13.1.0 < 13.1.x* | 13.1.x* |
| f5 | big-ip | >= 14.1.x < 14.1.5 | 14.1.5 |
| f5 | big-ip | >= 15.1.x < 15.1.5.1 | 15.1.5.1 |
| f5 | big-ip | >= 16.1.x < 16.1.3 | 16.1.3 |
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_access_policy_manager | >= 14.1.0 < 14.1.5 | 14.1.5 |
| f5 | big-ip_access_policy_manager | >= 15.1.0 < 15.1.6.1 | 15.1.6.1 |
| f5 | big-ip_access_policy_manager | >= 16.1.0 < 16.1.3 | 16.1.3 |
| f5 | big-ip_advanced_firewall_manager | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_advanced_firewall_manager | >= 14.1.0 < 14.1.5 | 14.1.5 |
| f5 | big-ip_advanced_firewall_manager | >= 15.1.0 < 15.1.6.1 | 15.1.6.1 |
| f5 | big-ip_advanced_firewall_manager | >= 16.1.0 < 16.1.3 | 16.1.3 |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_analytics | >= 14.1.0 < 14.1.5 | 14.1.5 |
| f5 | big-ip_analytics | >= 15.1.0 < 15.1.6.1 | 15.1.6.1 |
| f5 | big-ip_analytics | >= 16.1.0 < 16.1.3 | 16.1.3 |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_application_acceleration_manager | >= 14.1.0 < 14.1.5 | 14.1.5 |
| f5 | big-ip_application_acceleration_manager | >= 15.1.0 < 15.1.6.1 | 15.1.6.1 |
| f5 | big-ip_application_acceleration_manager | >= 16.1.0 < 16.1.3 | 16.1.3 |
| f5 | big-ip_application_security_manager | 13.1.0 – 13.1.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2022-35243: In BIG-IP Versions 16
vendor_f5·2022-08-04·CVSS 8.7
CVE-2022-35243 [HIGH] CWE-269 CVE-2022-35243: In BIG-IP Versions 16
CVE-2022-35243: In BIG-IP Versions 16
In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Analytics, BIG-IP DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, iControl REST
Affected Versions: 13.1.0 - 13.1.5; 14.1.0 - 14.1.5; 15.1.0 - 15.1.6.1; 16.1.0 - 16.1.3
F5 Advisory Articles: K1
GHSA
GHSA-pq49-99m6-6f97: In BIG-IP Versions 16
ghsa_unreviewed·2022-08-05
CVE-2022-35243 [CRITICAL] CWE-269 GHSA-pq49-99m6-6f97: In BIG-IP Versions 16
In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-04
Published