PT-2022-21931 · F5 · F5 Big-Ip

Published 2022-08-04 · Updated 2022-08-10 · CVE-2022-33947

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.x F5 BIG-IP versions 14.1.x through 14.1.4 F5 BIG-IP versions 15.1.x through 15.1.5 F5 BIG-IP versions 16.1.x through 16.1.2

Description A vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with at least operator role privileges to cause the Tomcat process to restart and perform unauthorized DNS requests and operations through undisclosed requests.

Recommendations For F5 BIG-IP version 13.1.x, there is no information about a newer version that contains a fix for this vulnerability. For F5 BIG-IP versions 14.1.x through 14.1.4, update to version 14.1.5 or later. For F5 BIG-IP versions 15.1.x through 15.1.5, update to version 15.1.6.1 or later. For F5 BIG-IP versions 16.1.x through 16.1.2, update to version 16.1.3 or later.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-33947

Affected Products

F5 Big-Ip

References · 3

• https://osv.dev/vulnerability/CVE-2022-33947 · Vendor Advisory
• https://support.f5.com/csp/article/K38893457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33947 · Security Note