Sign-up

ID

VAR-202201-1344


CVE

CVE-2022-23014


TITLE

BIG-IP APM  Input validation vulnerability in portal

Trust: 0.8

sources: JVNDB: JVNDB-2022-004272

DESCRIPTION

On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. BIG-IP APM Portal contains an input validation vulnerability.Service operation interruption (DoS) It may be in a state. F5 BIG-IP is an application delivery platform of F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management and other functions. The F5 BIG-IP APM input validation error vulnerability could be exploited by an attacker to cause a denial of service

Trust: 2.34

sources: NVD: CVE-2022-23014 // JVNDB: JVNDB-2022-004272 // CNVD: CNVD-2022-26841 // VULHUB: VHN-411885 // VULMON: CVE-2022-23014

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-26841

AFFECTED PRODUCTS

vendor:f5model:big-ip access policy managerscope:gteversion:15.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:15.1.4.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:16.1.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:16.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:ltversion:16.1.x

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:ltversion:15.1.x

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:15.1.4.1

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion:16.1.2

Trust: 0.8

vendor:f5model:big-ip access policy managerscope:eqversion: -

Trust: 0.8

vendor:f5model:big-ip apmscope:gteversion:15.1.0,<=15.1.4

Trust: 0.6

vendor:f5model:big-ip apmscope:gteversion:16.1.0,<=16.1.1

Trust: 0.6

sources: CNVD: CNVD-2022-26841 // JVNDB: JVNDB-2022-004272 // NVD: CVE-2022-23014

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-23014
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-23014
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-26841
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202201-1718
value: MEDIUM

Trust: 0.6

VULHUB: VHN-411885
value: MEDIUM

Trust: 0.1

VULMON: CVE-2022-23014
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-23014
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-26841
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-411885
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-23014
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2022-23014
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-26841 // VULHUB: VHN-411885 // VULMON: CVE-2022-23014 // JVNDB: JVNDB-2022-004272 // CNNVD: CNNVD-202201-1718 // NVD: CVE-2022-23014

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.1

problemtype:Inappropriate input confirmation (CWE-20) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-411885 // JVNDB: JVNDB-2022-004272 // NVD: CVE-2022-23014

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-1718

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202201-1718

PATCH

title:K93526903url:https://my.f5.com/manage/s/article/K93526903

Trust: 0.8

title:Patch for F5 BIG-IP APM Input Validation Error Vulnerability (CNVD-2022-26841)url:https://www.cnvd.org.cn/patchInfo/show/328886

Trust: 0.6

title:F5 BIG-IP APM Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=179206

Trust: 0.6

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: CNVD: CNVD-2022-26841 // VULMON: CVE-2022-23014 // JVNDB: JVNDB-2022-004272 // CNNVD: CNNVD-202201-1718

EXTERNAL IDS

db:NVDid:CVE-2022-23014

Trust: 4.0

db:JVNDBid:JVNDB-2022-004272

Trust: 0.8

db:CNVDid:CNVD-2022-26841

Trust: 0.6

db:AUSCERTid:ESB-2022.0330

Trust: 0.6

db:CS-HELPid:SB2022012016

Trust: 0.6

db:CNNVDid:CNNVD-202201-1718

Trust: 0.6

db:VULHUBid:VHN-411885

Trust: 0.1

db:VULMONid:CVE-2022-23014

Trust: 0.1

sources: CNVD: CNVD-2022-26841 // VULHUB: VHN-411885 // VULMON: CVE-2022-23014 // JVNDB: JVNDB-2022-004272 // CNNVD: CNNVD-202201-1718 // NVD: CVE-2022-23014

REFERENCES

url:https://support.f5.com/csp/article/k93526903

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-23014

Trust: 1.4

url:https://www.cybersecurity-help.cz/vdb/sb2022012016

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0330

Trust: 0.6

url:https://vigilance.fr/vulnerability/f5-big-ip-apm-denial-of-service-via-portal-access-37321

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: CNVD: CNVD-2022-26841 // VULHUB: VHN-411885 // VULMON: CVE-2022-23014 // JVNDB: JVNDB-2022-004272 // CNNVD: CNNVD-202201-1718 // NVD: CVE-2022-23014

SOURCES

db:CNVDid:CNVD-2022-26841
db:VULHUBid:VHN-411885
db:VULMONid:CVE-2022-23014
db:JVNDBid:JVNDB-2022-004272
db:CNNVDid:CNNVD-202201-1718
db:NVDid:CVE-2022-23014

LAST UPDATE DATE

2024-11-23T21:58:32.612000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-26841date:2022-04-07T00:00:00
db:VULHUBid:VHN-411885date:2022-02-01T00:00:00
db:VULMONid:CVE-2022-23014date:2022-02-01T00:00:00
db:JVNDBid:JVNDB-2022-004272date:2023-04-04T02:33:00
db:CNNVDid:CNNVD-202201-1718date:2022-02-07T00:00:00
db:NVDid:CVE-2022-23014date:2024-11-21T06:47:48.407

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-26841date:2022-04-07T00:00:00
db:VULHUBid:VHN-411885date:2022-01-25T00:00:00
db:VULMONid:CVE-2022-23014date:2022-01-25T00:00:00
db:JVNDBid:JVNDB-2022-004272date:2023-04-04T00:00:00
db:CNNVDid:CNNVD-202201-1718date:2022-01-19T00:00:00
db:NVDid:CVE-2022-23014date:2022-01-25T20:15:09.270