CVE-2023-28406

BIG-IP Configuration utility vulnerability

State: Published
Severity: 4.3 Medium
Published: May 3, 2023
Updated: Jan 29, 2025
Reserved: Apr 14, 2023

Description

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	f5

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
BIG-IPF5	17.1.0 and laterNot affected 17.0.0 and laterAffected 16.1.0 to before 16.1.3.4Affected 15.1.0 to before 15.1.8.2Affected 14.1.0 to before 14.1.5.4Affected 13.1.0 and laterAffected

References

https://my.f5.com/manage/s/article/K000132768vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.