Privilege escalation in F5 Big-Ip
CVE-2022-33962
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a self IP address, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability class: Privilege Escalation
EPSS: 0.002 (8.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- F5 Big-ip — versions 13.1.0, 14.1.x, 15.1.x
- F5 Big-ip_access_policy_manager — versions 17.0.0
- F5 Big-ip_advanced_firewall_manager — versions 17.0.0
- F5 Big-ip_analytics — versions 17.0.0
- F5 Big-ip_application_acceleration_manager — versions 17.0.0
- F5 Big-ip_application_security_manager — versions 17.0.0
- F5 Big-ip_domain_name_system — versions 17.0.0
- F5 Big-ip_fraud_protection_service — versions 17.0.0
- F5 Big-ip_global_traffic_manager — versions 17.0.0
- F5 Big-ip_link_controller — versions 17.0.0
Weakness classification (CWE)
References
- f5sirt@f5.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-33962?
- CVE-2022-33962 is a medium-severity vulnerability in F5 Big-Ip, classified under Improper Privilege Management. CVSS score: 6.7/10. Published 2022-08-04.
- How severe is CVE-2022-33962?
- Medium severity. CVSS v3 base score is 6.7 out of 10.