This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor f5 First view 2014-03-11
Product Big-Ip Global Traffic Manager Last view 2023-11-21
Version 11.5.3 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:f5:big-ip_global_traffic_manager

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
7.5 2023-11-21 CVE-2023-45886

The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute.

8.8 2023-10-26 CVE-2023-46748

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which

may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.

┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

9.8 2023-10-26 CVE-2023-46747

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

4.4 2023-10-10 CVE-2023-45219

Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.┬ ┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

8.7 2023-10-10 CVE-2023-43746

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.┬ A successful exploit can allow the attacker to cross a security boundary.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.8 2023-10-10 CVE-2023-43611

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.┬ This vulnerability is due to an incomplete fix for CVE-2023-38418.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

5.5 2023-10-10 CVE-2023-43485

When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.2 2023-10-10 CVE-2023-42768

When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.5 2023-10-10 CVE-2023-41964

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

9.9 2023-10-10 CVE-2023-41373

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-41085

When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-40542

When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

8.1 2023-10-10 CVE-2023-40537

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-10-10 CVE-2023-40534

When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

5.4 2023-08-02 CVE-2023-38423

A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

4.3 2023-08-02 CVE-2023-38419

An authenticated attacker with guest privileges or higher can cause the iControl SOAP process to terminate by sending undisclosed requests.┬ ┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1 2023-08-02 CVE-2023-38138

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1 2023-08-02 CVE-2023-3470

Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. ┬ The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information required to generate the correct password. ┬ On vCMP systems, all Guests share the same deterministic password, allowing those with TMSH access on one Guest to access keys of a different Guest.

The following BIG-IP hardware platforms are affected: 10350v-F, i5820-DF, i7820-DF, i15820-DF, 5250v-F, 7200v-F, 10200v-F, 6900-F, 8900-F, 11000-F, and 11050-F.

The BIG-IP rSeries r5920-DF and r10920-DF are not affected, nor does the issue affect software FIPS implementations or network HSM configurations.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 2023-05-03 CVE-2023-29163

When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

4.3 2023-05-03 CVE-2023-28406

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.1 2023-05-03 CVE-2023-27378

Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user.┬ Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

8.7 2022-12-07 CVE-2022-41800

In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.┬ ┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

8.8 2022-12-07 CVE-2022-41622

In all versions,┬

BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.┬ ┬

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

3.7 2022-10-19 CVE-2022-41983

On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send data unencrypted even with an SSL Profile applied.

CWE : Common Weakness Enumeration

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
%idName
13% (31) CWE-20 Improper Input Validation
11% (27) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
9% (21) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
4% (11) CWE-200 Information Exposure
3% (9) CWE-476 NULL Pointer Dereference
3% (9) CWE-401 Failure to Release Memory Before Removing Last Reference ('Memory L...
3% (8) CWE-269 Improper Privilege Management
3% (7) CWE-319 Cleartext Transmission of Sensitive Information
2% (5) CWE-264 Permissions, Privileges, and Access Controls
1% (4) CWE-404 Improper Resource Shutdown or Release
1% (4) CWE-362 Race Condition
1% (4) CWE-352 Cross-Site Request Forgery (CSRF)
1% (4) CWE-326 Inadequate Encryption Strength
1% (4) CWE-295 Certificate Issues
1% (4) CWE-284 Access Control (Authorization) Issues
1% (4) CWE-203 Information Exposure Through Discrepancy
1% (4) CWE-78 Improper Sanitization of Special Elements used in an OS Command ('O...
1% (4) CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path ...
1% (3) CWE-770 Allocation of Resources Without Limits or Throttling
1% (3) CWE-613 Insufficient Session Expiration
1% (3) CWE-532 Information Leak Through Log Files
1% (3) CWE-434 Unrestricted Upload of File with Dangerous Type
1% (3) CWE-399 Resource Management Errors
1% (3) CWE-287 Improper Authentication
1% (3) CWE-125 Out-of-bounds Read

SAINT Exploits

Description Link
F5 BIG-IP iControl REST vulnerability More info here

Snort® IPS/IDS

Date Description
2020-08-11 F5 BIG-IP Traffic Management User Interface remote code execution attempt
RuleID : 54484 - Type : SERVER-WEBAPP - Revision : 2
2020-08-06 F5 BIG-IP Traffic Management User Interface remote code execution attempt
RuleID : 54462 - Type : SERVER-WEBAPP - Revision : 3
2020-07-07 lodash defaultsDeep prototype pollution attempt
RuleID : 54184 - Type : SERVER-OTHER - Revision : 1
2017-02-10 F5 BIG-IP TLS session ticket implementation uninitialized memory disclosure a...
RuleID : 41548 - Type : SERVER-OTHER - Revision : 3
2016-03-15 Linux kernel SCTP handshake COOKIE ECHO Chunks denial of service attempt
RuleID : 37654 - Type : OS-LINUX - Revision : 2
2016-03-14 Linux kernel SCTP handshake COOKIE ECHO Chunks denial of service attempt
RuleID : 37408 - Type : OS-LINUX - Revision : 2
2016-03-14 F5 BIG-IP iControl API arbitrary command execution attempt
RuleID : 36778 - Type : SERVER-WEBAPP - Revision : 2

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-11 Name: The remote Virtuozzo host is missing multiple security updates.
File: Virtuozzo_VZA-2018-075.nasl - Type: ACT_GATHER_INFO
2019-01-10 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa10917_184R1.nasl - Type: ACT_GATHER_INFO
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-50075276e8.nasl - Type: ACT_GATHER_INFO
2018-12-21 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL23328310.nasl - Type: ACT_GATHER_INFO
2018-12-21 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL61620494.nasl - Type: ACT_GATHER_INFO
2018-12-14 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL95343321.nasl - Type: ACT_GATHER_INFO
2018-12-13 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL42027747.nasl - Type: ACT_GATHER_INFO
2018-12-11 Name: The remote EulerOS host is missing multiple security updates.
File: EulerOS_SA-2018-1406.nasl - Type: ACT_GATHER_INFO
2018-12-05 Name: The remote PhotonOS host is missing multiple security updates.
File: PhotonOS_PHSA-2018-2_0-0101.nasl - Type: ACT_GATHER_INFO
2018-11-16 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2018-3083.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL00363258.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL01067037.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL02043709.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL02714910.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL03165684.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL05112543.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL05263202.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL07550539.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL11718033.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL12044607.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL16248201.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL19361245.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL20134942.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL20222812.nasl - Type: ACT_GATHER_INFO
2018-11-02 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL23124150.nasl - Type: ACT_GATHER_INFO