Session Awareness Vulnerability in F5 BIG-IP Web Application Security
CVE-2022-26890

7.5HIGH

Key Information:

Vendor

F5
Status
Big-ip Advanced Waf, Asm, And Apm
Vendor
CVE Published:
5 May 2022

What is CVE-2022-26890?

A vulnerability exists in F5 BIG-IP versions of Advanced WAF, ASM, and APM that can lead to the termination of the bd process. This occurs when these components are configured on a virtual server, and the ASM policy has Session Awareness enabled with the 'Use APM Username and Session ID' option. Undisclosed requests can exploit this configuration, potentially leading to service disruptions. It’s critical to monitor and address affected versions to maintain security and system stability.

Affected Version(s)

BIG-IP Advanced WAF, ASM, and APM 16.1.x < 16.1.2.1

BIG-IP Advanced WAF, ASM, and APM 15.1.x < 15.1.5

BIG-IP Advanced WAF, ASM, and APM 14.1.x < 14.1.4.6

References

https://support.f5.com/csp/article/K03442392
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.