FKIE_CVE-2022-26890

Vulnerability from fkie_nvd - Published: 2022-05-05 17:15 - Updated: 2024-11-21 06:54
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
References
f5sirt@f5.comhttps://support.f5.com/csp/article/K03442392Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.f5.com/csp/article/K03442392Vendor Advisory
Impacted products
Vendor Product Version
f5 big-ip_access_policy_manager 13.1.0
f5 big-ip_access_policy_manager 13.1.1
f5 big-ip_access_policy_manager 13.1.3
f5 big-ip_access_policy_manager 13.1.4
f5 big-ip_access_policy_manager 13.1.5
f5 big-ip_access_policy_manager 14.1.0
f5 big-ip_access_policy_manager 14.1.2
f5 big-ip_access_policy_manager 14.1.3
f5 big-ip_access_policy_manager 14.1.4
f5 big-ip_access_policy_manager 15.1.0
f5 big-ip_access_policy_manager 15.1.1
f5 big-ip_access_policy_manager 15.1.2
f5 big-ip_access_policy_manager 15.1.3
f5 big-ip_access_policy_manager 15.1.4
f5 big-ip_access_policy_manager 15.1.5
f5 big-ip_access_policy_manager 16.1.0
f5 big-ip_access_policy_manager 16.1.1
f5 big-ip_access_policy_manager 16.1.2
f5 big-ip_advanced_web_application_firewall 13.1.0
f5 big-ip_advanced_web_application_firewall 13.1.1
f5 big-ip_advanced_web_application_firewall 13.1.3
f5 big-ip_advanced_web_application_firewall 13.1.4
f5 big-ip_advanced_web_application_firewall 13.1.5
f5 big-ip_advanced_web_application_firewall 14.1.0
f5 big-ip_advanced_web_application_firewall 14.1.2
f5 big-ip_advanced_web_application_firewall 14.1.3
f5 big-ip_advanced_web_application_firewall 14.1.4
f5 big-ip_advanced_web_application_firewall 15.1.0
f5 big-ip_advanced_web_application_firewall 15.1.1
f5 big-ip_advanced_web_application_firewall 15.1.2
f5 big-ip_advanced_web_application_firewall 15.1.3
f5 big-ip_advanced_web_application_firewall 15.1.4
f5 big-ip_advanced_web_application_firewall 15.1.5
f5 big-ip_advanced_web_application_firewall 16.1.0
f5 big-ip_advanced_web_application_firewall 16.1.1
f5 big-ip_advanced_web_application_firewall 16.1.2
f5 big-ip_application_security_manager 13.1.0
f5 big-ip_application_security_manager 13.1.1
f5 big-ip_application_security_manager 13.1.3
f5 big-ip_application_security_manager 13.1.4
f5 big-ip_application_security_manager 13.1.5
f5 big-ip_application_security_manager 14.1.0
f5 big-ip_application_security_manager 14.1.2
f5 big-ip_application_security_manager 14.1.3
f5 big-ip_application_security_manager 14.1.4
f5 big-ip_application_security_manager 15.1.0
f5 big-ip_application_security_manager 15.1.1
f5 big-ip_application_security_manager 15.1.2
f5 big-ip_application_security_manager 15.1.3
f5 big-ip_application_security_manager 15.1.4
f5 big-ip_application_security_manager 15.1.5
f5 big-ip_application_security_manager 16.1.0
f5 big-ip_application_security_manager 16.1.1
f5 big-ip_application_security_manager 16.1.2
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5491BC3C-EE0C-43FA-B870-BBF9FC4FADB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "41408E51-04CC-4208-9DBA-0A5A90EFC7A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C90F3BA6-6466-48C5-A621-B44549419496",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "79A3A605-EBE9-4C50-B6F4-5FBD385FA8B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:13.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3E688B1-28C4-4F9A-9474-381FD22E792D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "25DAD24A-2D43-498E-BC43-183B669EA1FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B25A33B9-2485-4D80-8F49-9B4688A39345",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D3E81E7-3E6A-46AD-827D-14046D93144E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:14.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9416AE8-7C48-4986-99E8-5F313715B6B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCA6CE41-1D13-4A7A-94D8-C0D5740870A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "29041413-B405-42A6-B9E9-A3E7C3AC1CB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F0C4673-2F1D-45B6-BC18-83EF68BA3601",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0148360C-1167-4FF9-B231-3D53890BD932",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "214D3CD8-6A1A-4119-B107-0363D34B3458",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:15.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "6CA06267-4A87-4249-8A08-5A78BDCEE884",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF96CE38-E834-475C-92AD-97D904D8F831",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "702ACADF-C7FF-43C9-89A9-5F464718F800",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:16.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7E9747B-6167-4E8B-AF48-AA55C900C872",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:13.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B0CB7DF-0C05-409E-9BE1-587717BD2563",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:13.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7341E8FE-A103-4818-B38C-CCF2710C999B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:13.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "410A7A93-500B-4CBB-8841-16E7DE4101DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:13.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "441413AF-290D-43DF-B41E-61DB3598BEB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:13.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE4838A8-A7AD-44EE-A5CC-48A32C0E456A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:14.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "598EE8AB-76D3-464E-B8C3-47533A22F879",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:14.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "206EB22C-AC2A-4A4E-8531-98E43EF497DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:14.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "769F8D7B-2052-4205-B255-9842A22DF963",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:14.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5F55C04B-A248-47C1-8EF5-933E4CFBB3A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:15.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDE52157-F1BB-4BCA-B582-48D826BBD0E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:15.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD2EF76F-9A4D-4DEC-B7F6-ED7DAA16766D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:15.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3F14F4EE-8E16-4E0C-8FAE-5846323DD379",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:15.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E330DBEF-9020-49C1-886F-E661334BCC2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:15.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "48D32035-7284-4D22-A243-CFEA5B01734B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:15.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "927D1FD4-47F3-4A72-A360-B996892C2E47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:16.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "55D6DDE1-8168-4681-8B68-3A3F47090994",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:16.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E09B41FA-2A79-447A-9C91-85FFD8099C79",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:16.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E031E7B7-C66C-4BC7-9BB8-F42A2B9517AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:13.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5FDBD38-369B-4007-8D9A-B65B83B2AABD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:13.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "69F18D98-3C29-4012-8A3A-0D7FB55F5735",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:13.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "168FDFB8-CD1F-49C7-89BB-87278795E582",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:13.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BAFFCAB-144B-4C2F-88F8-D35930012F44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:13.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D030F54-8F3E-4844-8B51-B93A31805010",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:14.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "907FEE11-DF3B-4BE7-9BAE-5F6BE20E469D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:14.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "49C435C8-DA39-41AF-9E42-AE50C96F9C66",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:14.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "817F7B3C-1CAC-4BD3-BD1A-C271C9516701",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:14.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B89FE04-D25D-4FF0-9421-B8BED0F77997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:15.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "14612AC5-945C-4402-AFF0-5FCE11B7C785",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:15.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A03DD77-08C8-482F-8F79-48396ED0BF1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:15.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "219F951F-C59B-4844-8558-6D07D067DF7E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:15.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE8FA530-5502-4FE1-A234-5E313D71B931",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:15.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "6578F36C-12EF-49E4-9012-2ECCE8770A92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:15.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "00141CBE-3AF5-40C3-B9D6-E9E61CFABECB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:16.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "56FC4AD6-EC04-4BC0-8B13-6AE9805AA8F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:16.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1BC7E64-0621-487A-A612-C82CC040FD90",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:16.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "46203B9C-8815-44FC-809B-A24F988CC5AD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the \"Use APM Username and Session ID\" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
    },
    {
      "lang": "es",
      "value": "En F5 BIG-IP Advanced WAF, ASM y APM versiones 16.1.x anteriores a 16.1.2.1, 15.1.x anteriores a 15.1.5, 14.1.x anteriores a 14.1.4.6 y 13.1.x anteriores a 13.1. 5, cuando ASM o Advanced WAF, as\u00ed como APM, est\u00e1n configurados en un servidor virtual, la pol\u00edtica de ASM est\u00e1 configurada con Session Awareness, y la opci\u00f3n \"Use APM Username and Session ID\" est\u00e1 habilitada, las peticiones no reveladas pueden causar la finalizaci\u00f3n del proceso bd. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no son evaluadas"
    }
  ],
  "id": "CVE-2022-26890",
  "lastModified": "2024-11-21T06:54:44.650",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-05-05T17:15:12.390",
  "references": [
    {
      "source": "f5sirt@f5.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.f5.com/csp/article/K03442392"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.f5.com/csp/article/K03442392"
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "f5sirt@f5.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.