PT-2024-20092 · F5 · F5 Big-Ip

Published 2024-02-14 · Updated 2024-02-14 · CVE-2024-23805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP (affected versions not specified)

Description Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when the HTTP Analytics profile with URLs enabled under Collected Entities is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled. For BIG-IP Advanced WAF and ASM, this may also occur when either a DoS or Bot Defense profile is configured on a virtual server and the DB variables avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI are enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2024-23805

Affected Products

F5 Big-Ip

References · 6

• https://osv.dev/vulnerability/CVE-2024-23805 · Vendor Advisory
• https://my.f5.com/manage/s/article/K000137334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23805 · Security Note
• https://twitter.com/VulmonFeeds/status/1757852982102597795 · Twitter Post
• https://twitter.com/cracbot/status/1758008318856200376 · Twitter Post
• https://twitter.com/CVEnew/status/1757806671793951075 · Twitter Post