PT-2023-18485 · F5 · Big-Ip

Published 2023-02-01 · Updated 2023-02-09 · CVE-2023-22418

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 13.1.x BIG-IP versions 14.1.x before 14.1.5.3 BIG-IP versions 15.1.x before 15.1.7 BIG-IP versions 16.1.x before 16.1.3.3 BIG-IP versions 17.0.x before 17.0.0.2

Description An open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI.

Recommendations For versions 13.1.x, update to a version that is still supported and has the fix for this issue. For versions 14.1.x before 14.1.5.3, update to version 14.1.5.3 or later. For versions 15.1.x before 15.1.7, update to version 15.1.7 or later. For versions 16.1.x before 16.1.3.3, update to version 16.1.3.3 or later. For versions 17.0.x before 17.0.0.2, update to version 17.0.0.2 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-22418

Affected Products

Big-Ip

References · 6

• https://my.f5.com/manage/s/article/K95503300 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22418 · Security Note
• https://t.me/cibsecurity/57324 · Telegram Post
• https://t.me/cvenotify/43995 · Telegram Post
• https://t.me/cvenotify/43346 · Telegram Post