CVE-2023-43746
published 2023-10-10CVE-2023-43746: When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP…
PriorityP347high8.7CVSS 3.1
AVNACLPRHUINSCCHIHAN
EPSS
0.43%
35.4th percentile
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
76 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip | >= 13.1.0 < * | * |
| f5 | big-ip | >= 14.1.0 < * | * |
| f5 | big-ip | >= 15.1.0 < 15.1.9 | 15.1.9 |
| f5 | big-ip | >= 16.1.0 < 16.1.4 | 16.1.4 |
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | 13.1.0 – 14.1.5 | — |
| f5 | big-ip_access_policy_manager | >= 15.1.0 < 15.1.9 | 15.1.9 |
| f5 | big-ip_access_policy_manager | >= 16.1.0 < 16.1.4 | 16.1.4 |
| f5 | big-ip_advanced_firewall_manager | 13.1.0 – 14.1.5 | — |
| f5 | big-ip_advanced_firewall_manager | >= 15.1.0 < 15.1.9 | 15.1.9 |
| f5 | big-ip_advanced_firewall_manager | >= 16.1.0 < 16.1.4 | 16.1.4 |
| f5 | big-ip_advanced_waf | — | — |
| f5 | big-ip_advanced_web_application_firewall | 13.1.0 – 14.1.5 | — |
| f5 | big-ip_advanced_web_application_firewall | >= 15.1.0 < 15.1.9 | 15.1.9 |
| f5 | big-ip_advanced_web_application_firewall | >= 16.1.0 < 16.1.4 | 16.1.4 |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 13.1.0 – 14.1.5 | — |
| f5 | big-ip_analytics | >= 15.1.0 < 15.1.9 | 15.1.9 |
| f5 | big-ip_analytics | >= 16.1.0 < 16.1.4 | 16.1.4 |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 13.1.0 – 14.1.5 | — |
| f5 | big-ip_application_acceleration_manager | >= 15.1.0 < 15.1.9 | 15.1.9 |
| f5 | big-ip_application_acceleration_manager | >= 16.1.0 < 16.1.4 | 16.1.4 |
| f5 | big-ip_application_security_manager | 13.1.0 – 14.1.5 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r7qm-xv29-cxj4: When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG
ghsa_unreviewed·2023-10-10
CVE-2023-43746 [HIGH] CWE-267 GHSA-r7qm-xv29-cxj4: When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
F5
CVE-2023-43746: When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance...
vendor_f5·2023-10-10·CVSS 8.7
CVE-2023-43746 [HIGH] CWE-267 CVE-2023-43746: When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance...
CVE-2023-43746: When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance...
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP AVR, BIG-IP Advanced WAF, BIG-IP Analytics, BIG-IP CGNAT, BIG-IP DHD, BIG-IP DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP SSLO, BIG-IP WebAccelerator, BIG-IP WebSafe
Affected Versions: 13.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-10-10
Published