CVE-2022-41770
published 2022-10-19CVE-2022-41770: In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.60%
44.5th percentile
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.
Affected
77 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip | >= 13.1.0 < 13.1.x* | 13.1.x* |
| f5 | big-ip | >= 14.1.x < 14.1.5.1 | 14.1.5.1 |
| f5 | big-ip | >= 15.1.x < 15.1.7 | 15.1.7 |
| f5 | big-ip | >= 16.1.x < 16.1.3.1 | 16.1.3.1 |
| f5 | big-ip | >= 17.0.x < 17.0.0.1 | 17.0.0.1 |
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_access_policy_manager | >= 14.1.0 < 14.1.5.1 | 14.1.5.1 |
| f5 | big-ip_access_policy_manager | >= 15.1.0 < 15.1.7 | 15.1.7 |
| f5 | big-ip_access_policy_manager | >= 16.1.0 < 16.1.3.1 | 16.1.3.1 |
| f5 | big-ip_access_policy_manager | >= 17.0.0 < 17.0.0.1 | 17.0.0.1 |
| f5 | big-ip_advanced_firewall_manager | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_advanced_firewall_manager | >= 14.1.0 < 14.1.5.1 | 14.1.5.1 |
| f5 | big-ip_advanced_firewall_manager | >= 15.1.0 < 15.1.7 | 15.1.7 |
| f5 | big-ip_advanced_firewall_manager | >= 16.1.0 < 16.1.3.1 | 16.1.3.1 |
| f5 | big-ip_advanced_firewall_manager | >= 17.0.0 < 17.0.0.1 | 17.0.0.1 |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 13.1.0 – 13.1.5 | — |
| f5 | big-ip_analytics | >= 14.1.0 < 14.1.5.1 | 14.1.5.1 |
| f5 | big-ip_analytics | >= 15.1.0 < 15.1.7 | 15.1.7 |
| f5 | big-ip_analytics | >= 16.1.0 < 16.1.3.1 | 16.1.3.1 |
| f5 | big-ip_analytics | >= 17.0.0 < 17.0.0.1 | 17.0.0.1 |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 13.1.0 – 13.1.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2022-41770: In BIG-IP versions 17
vendor_f5·2022-10-19·CVSS 6.5
CVE-2022-41770 [MEDIUM] CWE-400 CVE-2022-41770: In BIG-IP versions 17
CVE-2022-41770: In BIG-IP versions 17
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Analytics, BIG-IP DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IQ, iControl REST
Affected Versions: 13.1.0 - 13.1.5; 14.1.0 - 14.1.5.1; 15.1.0 - 15.1.7; 16.1.0 - 16.1.3.1; 17.0.0 - 17.0.0.1; 7.1.0; 8.0.0 - 8.2.0
F5 Advisory Articles: K22505850
F5 References: https://support.f5.com/csp/article/K22505850
GHSA
GHSA-h6rh-598h-xcw9: In BIG-IP versions 17
ghsa_unreviewed·2022-10-20
CVE-2022-41770 [MEDIUM] CWE-400 GHSA-h6rh-598h-xcw9: In BIG-IP versions 17
In BIG-IP versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ all versions of 8.x and 7.x, an authenticated iControl REST user can cause an increase in memory resource utilization, via undisclosed requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-10-19
Published