CVE-2024-28883

published 2024-05-08

CVE-2024-28883: An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may allow an attacker to bypass F5…

Priority P3 46 high 7.4 CVSS 3.1

AV N AC H PR N UI N S U C H I H A N

An origin validation vulnerability exists in

BIG-IP APM browser network access VPN client

for Windows, macOS and Linux which may allow an attacker to bypass F5 endpoint inspection.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip	>= 15.1.0 < 15.1.10.3	15.1.10.3
f5	big-ip	>= 16.1.0 < 16.1.4.2	16.1.4.2
f5	big-ip	>= 17.1.0 < 17.1.1	17.1.1
f5	big-ip_access_policy_manager	—	—
f5	big-ip_access_policy_manager	>= 15.1.0 < 15.1.10.3	15.1.10.3
f5	big-ip_access_policy_manager	>= 16.1.0 < 16.1.4.2	16.1.4.2
f5	big-ip_access_policy_manager_client	—	—
f5	big-ip_access_policy_manager_client	>= 7.2.3 < 7.2.4.4	7.2.4.4
f5	big-ip_apm	—	—
f5	big-ip_edge_client	>= 7.2.3 < 7.2.4.4	7.2.4.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-346