PT-2022-18539 · F5 · F5 Big-Ip Apm

Published 2022-05-05 · Updated 2022-05-13 · CVE-2022-27634

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions prior to 15.1.5.1 F5 BIG-IP APM versions 16.1.x prior to 16.1.2.2

Description The issue arises from improper validation of configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy. This can lead to privilege escalation or remote code execution.

Recommendations For versions 16.1.x prior to 16.1.2.2, update to version 16.1.2.2 or later to resolve the issue. For versions 15.1.x prior to 15.1.5.1, update to version 15.1.5.1 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-27634

Affected Products

F5 Big-Ip Apm

References · 3

• https://support.f5.com/csp/article/K57555833 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27634 · Security Note