Vulnerability in F5 Big-Ip
CVE-2022-34865
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability class: Improper Certificate Validation
EPSS: 0.004 (30.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- F5 Big-ip — versions 13.1.0, 14.1.x, 15.1.x
- F5 Big-ip_access_policy_manager
- F5 Big-ip_advanced_firewall_manager
- F5 Big-ip_analytics
- F5 Big-ip_application_acceleration_manager
- F5 Big-ip_application_security_manager
- F5 Big-ip_domain_name_system
- F5 Big-ip_fraud_protection_service
- F5 Big-ip_global_traffic_manager
- F5 Big-ip_link_controller
Weakness classification (CWE)
References
- f5sirt@f5.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-34865?
- CVE-2022-34865 is a medium-severity vulnerability in F5 Big-Ip, classified under Improper Certificate Validation. CVSS score: 4.8/10. Published 2022-08-04.
- How severe is CVE-2022-34865?
- Medium severity. CVSS v3 base score is 4.8 out of 10.