Riskcovery

CVE-2022-35243

Authenticated iControl REST in Appliance mode vulnerability CVE-2022-35243

State
Published
Severity
8.7 High
Published
Aug 4, 2022
Updated
Sep 16, 2024
Reserved
Jul 19, 2022

Read the record on cve.org

Description

In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSSScoreVectorSource
3.18.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nf5

Weaknesses

  • CWE-269 Improper Privilege Management

Affected Products

ProductVersions
BIG-IPF5
  • 13.1.0 to before 13.1.x*Affected
  • 14.1.x to before 14.1.5Affected
  • 15.1.x to before 15.1.5.1Affected
  • 16.1.x to before 16.1.3Affected
  • 17.0.0 to before 17.0.x*Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.