BIG-IP Edge Client for Windows vulnerability (F5 APM Clients)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.20 % · percentile 9 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- f5
- NVD status
- Modified
Description
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weaknesses (CWE)
- CWE-427 — Uncontrolled Search Path Element
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | f5 |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | NVD · f5sirt@f5.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Secondary) |
European references
- ENISA EUVD · EUVD-2023-26447
- GCVE · GCVE-0-2023-22283
CERT-FR advisories
- CERTFR-2023-AVI-0088 — Multiples vulnérabilités dans F5 BIG-IP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:clients:*:*:*≥ 7.2.2 < 7.2.3.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 14.1.0 ≤ 14.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 15.1.0 ≤ 15.1.8cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 16.1.0 ≤ 16.1.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 17.0.0 < 17.0.0.2cpe:2.3:a:f5:big-ip_edge:-:*:*:*:clients:windows:*:*
Affected products
| Product | Versions |
|---|---|
| F5 · APM Clients | affected 7.1.5 < 7.2.3.1 ; unaffected 7.2.4 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |