CVE-2022-27806

8.7HIGH

Key Information:

Vendor
F5
Status
Big-ip (advanced Waf, Apm, Asm)
Big-ip Guided Configuration (gc)
Vendor
CVE Published:
5 May 2022

Summary

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing command injection vulnerabilities in undisclosed URIs in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected Version(s)

BIG-IP (Advanced WAF, APM, ASM) 16.1.x

BIG-IP (Advanced WAF, APM, ASM) 15.1.x

BIG-IP (Advanced WAF, APM, ASM) 14.1.x

References

https://support.f5.com/csp/article/K68647001
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.