Sign-up

ID

VAR-202302-0029


CVE

CVE-2023-22374


TITLE

BIG-IP  Format string vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-003165

DESCRIPTION

A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. In appliance mode BIG-IP, a successful exploit of this vulnerability can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. BIG-IP Exists in a format string vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2023-22374 // JVNDB: JVNDB-2023-003165 // VULHUB: VHN-451923 // VULMON: CVE-2023-22374

AFFECTED PRODUCTS

vendor:f5model:big-ip ddos hybrid defenderscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip ddos hybrid defenderscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip ddos hybrid defenderscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip link controllerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip ddos hybrid defenderscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip ddos hybrid defenderscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip ddos hybrid defenderscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip ddos hybrid defenderscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:16.1.2.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:eqversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:16.1.3

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.1.4.6

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:eqversion:17.0.0

Trust: 1.0

vendor:f5model:big-ip ssl orchestratorscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:14.1.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:15.1.8

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:15.1.5.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:eqversion:13.1.5

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip ddos hybrid defenderscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-003165 // NVD: CVE-2023-22374

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2023-22374
value: HIGH

Trust: 1.8

f5sirt@f5.com: CVE-2023-22374
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202302-092
value: HIGH

Trust: 0.6

f5sirt@f5.com:
baseSeverity: HIGH
baseScore: 8.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 6.0
version: 3.1

Trust: 2.0

NVD: CVE-2023-22374
baseSeverity: HIGH
baseScore: 8.5
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-003165 // NVD: CVE-2023-22374 // NVD: CVE-2023-22374 // CNNVD: CNNVD-202302-092

PROBLEMTYPE DATA

problemtype:CWE-134

Trust: 1.0

problemtype:Format string problem (CWE-134) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-003165 // NVD: CVE-2023-22374

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202302-092

TYPE

format string error

Trust: 0.6

sources: CNNVD: CNNVD-202302-092

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2023-22374

PATCH
title:K000130415url:https://my.f5.com/manage/s/article/k000130415
Trust: 0.8
title:F5 BIG-IP Fixes for formatting string error vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=229219
Trust: 0.6
title: - url:https://github.com/live-hack-cve/cve-2023-22374 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2023-22374 // 
            
            
            
            JVNDB: JVNDB-2023-003165 // 
            
            
            
            CNNVD: CNNVD-202302-092

EXTERNAL IDS
db:NVDid:CVE-2023-22374
Trust: 3.4
db:JVNDBid:JVNDB-2023-003165
Trust: 0.8
db:AUSCERTid:ESB-2023.0638
Trust: 0.6
db:CNNVDid:CNNVD-202302-092
Trust: 0.6
db:VULHUBid:VHN-451923
Trust: 0.1
db:VULMONid:CVE-2023-22374
Trust: 0.1
sources:
            
            
            VULHUB: VHN-451923 // 
            
            
            
            VULMON: CVE-2023-22374 // 
            
            
            
            JVNDB: JVNDB-2023-003165 // 
            
            
            
            NVD: CVE-2023-22374 // 
            
            
            
            CNNVD: CNNVD-202302-092

REFERENCES
url:https://my.f5.com/manage/s/article/k000130415
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-22374
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2023.0638
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2023-22374/
Trust: 0.6
url:https://github.com/live-hack-cve/cve-2023-22374
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-451923 // 
            
            
            
            VULMON: CVE-2023-22374 // 
            
            
            
            JVNDB: JVNDB-2023-003165 // 
            
            
            
            NVD: CVE-2023-22374 // 
            
            
            
            CNNVD: CNNVD-202302-092

SOURCES
db:VULHUBid:VHN-451923
db:VULMONid:CVE-2023-22374
db:JVNDBid:JVNDB-2023-003165
db:NVDid:CVE-2023-22374
db:CNNVDid:CNNVD-202302-092

LAST UPDATE DATE
2023-12-18T13:26:49.879000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-451923date:2023-02-09T00:00:00
db:VULMONid:CVE-2023-22374date:2023-02-01T00:00:00
db:JVNDBid:JVNDB-2023-003165date:2023-09-01T07:49:00
db:NVDid:CVE-2023-22374date:2023-10-04T16:55:31.157
db:CNNVDid:CNNVD-202302-092date:2023-03-16T00:00:00

SOURCES RELEASE DATE
db:VULHUBid:VHN-451923date:2023-02-01T00:00:00
db:VULMONid:CVE-2023-22374date:2023-02-01T00:00:00
db:JVNDBid:JVNDB-2023-003165date:2023-09-01T00:00:00
db:NVDid:CVE-2023-22374date:2023-02-01T18:15:11.363
db:CNNVDid:CNNVD-202302-092date:2023-02-01T00:00:00