PT-2023-18485 · F5 · Big-Ip

Publicado 2023-02-01 · Atualizado 2023-02-09 · CVE-2023-22418

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 13.1.x BIG-IP versions 14.1.x before 14.1.5.3 BIG-IP versions 15.1.x before 15.1.7 BIG-IP versions 16.1.x before 16.1.3.3 BIG-IP versions 17.0.x before 17.0.0.2

Description An open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI.

Recommendations For versions 13.1.x, update to a version that is still supported and has the fix for this issue. For versions 14.1.x before 14.1.5.3, update to version 14.1.5.3 or later. For versions 15.1.x before 15.1.7, update to version 15.1.7 or later. For versions 16.1.x before 16.1.3.3, update to version 16.1.3.3 or later. For versions 17.0.x before 17.0.0.2, update to version 17.0.0.2 or later.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2023-22418

Produtos afetados

Big-Ip

Referências · 6

• https://my.f5.com/manage/s/article/K95503300 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-22418 · Aviso do Fabricante
• https://t.me/cibsecurity/57324 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22418 · Nota de Segurança
• https://t.me/cvenotify/43995 · Publicação no Telegram
• https://t.me/cvenotify/43346 · Publicação no Telegram