Undisclosed Requests Can Cause TMM Termination for HTTP Analytics and Advanced WAF/ASM
CVE-2024-23805

7.5HIGH

Key Information:

Vendor
F5
Status
Big-ip
Vendor
CVE Published:
14 February 2024

Summary

The vulnerability involves the Traffic Management Microkernel (TMM) being susceptible to termination due to certain undisclosed requests. This issue arises particularly when the Application Visibility and Reporting module is used, especially with HTTP Analytics profiles that include URLs on virtual servers combined with enabled database variables such as avr.IncludeServerInURI or avr.CollectOnlyHostnameFromURI. The BIG-IP Advanced WAF and ASM are also affected under similar circumstances when specific DoS or Bot Defense profiles are configured. It is important to note that by default, the database variables avr.IncludeServerInURI and avr.CollectOnlyHostnameFromURI are disabled, thereby requiring careful configuration to mitigate the risk.

Affected Version(s)

BIG-IP 17.1.0 < 17.1.1

BIG-IP 16.1.0 < 16.1.4

BIG-IP 15.1.0 < 15.1.10

References

https://my.f5.com/manage/s/article/K000137334
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
.