Details of VAR-202205-0398

ID

VAR-202205-0398

CVE

CVE-2022-25946

TITLE

plural F5 Networks Vulnerability related to insufficient data integrity verification in products

Trust: 0.8

sources: JVNDB: JVNDB-2022-010793

DESCRIPTION

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. plural F5 Networks The product contains a vulnerability related to insufficient data integrity verification.Information may be obtained and information may be tampered with

Trust: 1.8

sources: NVD: CVE-2022-25946 // JVNDB: JVNDB-2022-010793 // VULHUB: VHN-419822 // VULMON: CVE-2022-25946

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	13.1.1	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	15.1.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	14.1.4	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	13.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	14.1.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	13.1.4	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	16.1.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	13.1.5	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	14.1.3	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	15.1.5	Trust: 1.0
vendor:	f5	model:	big-ip guided configuration	scope:	lte	version:	9.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.1.4	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	16.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.1.1	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	14.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	14.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	13.1.1	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	16.1.2	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	15.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	13.1.4	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.1.5	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	13.1.5	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	14.1.4	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	13.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	16.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	16.1.1	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	14.1.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.1	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.4	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	13.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	14.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	16.1.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	14.1.2	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	14.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.5	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	16.1.2	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	13.1.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	14.1.4	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	16.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	13.1.4	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	13.1.5	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	14.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	eq	version:	15.1.4	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	16.1.2	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip guided configuration	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip advanced web application firewall	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-010793 // NVD: CVE-2022-25946

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-25946
value:	MEDIUM
Trust: 1.0
f5sirt@f5.com:	CVE-2022-25946
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-25946
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202205-2114
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-419822
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2022-25946
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2022-25946
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-419822
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2022-25946
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	1.2
impactScore:	5.2
version:	3.1
Trust: 1.0
f5sirt@f5.com:	CVE-2022-25946
baseSeverity:	HIGH
baseScore:	8.7
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	5.8
version:	3.1
Trust: 1.0
NVD:	CVE-2022-25946
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-419822 // VULMON: CVE-2022-25946 // JVNDB: JVNDB-2022-010793 // CNNVD: CNNVD-202205-2114 // NVD: CVE-2022-25946 // NVD: CVE-2022-25946

PROBLEMTYPE DATA

problemtype:	CWE-354	Trust: 1.1
problemtype:	Incomplete data integrity verification (CWE-354) [ others ]	Trust: 0.8

sources: VULHUB: VHN-419822 // JVNDB: JVNDB-2022-010793 // NVD: CVE-2022-25946

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202205-2114

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202205-2114

PATCH

title:

K52322100

url:

https://my.f5.com/manage/s/article/K52322100

Trust: 0.8

sources: JVNDB: JVNDB-2022-010793

EXTERNAL IDS

db:	NVD	id:	CVE-2022-25946	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-010793	Trust: 0.8
db:	AUSCERT	id:	ESB-2022.2148	Trust: 0.6
db:	CNNVD	id:	CNNVD-202205-2114	Trust: 0.6
db:	VULHUB	id:	VHN-419822	Trust: 0.1
db:	VULMON	id:	CVE-2022-25946	Trust: 0.1

sources: VULHUB: VHN-419822 // VULMON: CVE-2022-25946 // JVNDB: JVNDB-2022-010793 // CNNVD: CNNVD-202205-2114 // NVD: CVE-2022-25946

REFERENCES

url:	https://support.f5.com/csp/article/k52322100	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-25946	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-25946/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2022.2148	Trust: 0.6
url:	https://vigilance.fr/vulnerability/f5-big-ip-multiple-vulnerabilities-38241	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/354.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-419822 // VULMON: CVE-2022-25946 // JVNDB: JVNDB-2022-010793 // CNNVD: CNNVD-202205-2114 // NVD: CVE-2022-25946

SOURCES

db:	VULHUB	id:	VHN-419822
db:	VULMON	id:	CVE-2022-25946
db:	JVNDB	id:	JVNDB-2022-010793
db:	CNNVD	id:	CNNVD-202205-2114
db:	NVD	id:	CVE-2022-25946

LAST UPDATE DATE

2024-08-14T15:27:17.923000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-419822	date:	2022-05-16T00:00:00
db:	VULMON	id:	CVE-2022-25946	date:	2022-05-16T00:00:00
db:	JVNDB	id:	JVNDB-2022-010793	date:	2023-08-17T05:50:00
db:	CNNVD	id:	CNNVD-202205-2114	date:	2022-05-17T00:00:00
db:	NVD	id:	CVE-2022-25946	date:	2022-05-16T12:49:44.073

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-419822	date:	2022-05-05T00:00:00
db:	VULMON	id:	CVE-2022-25946	date:	2022-05-05T00:00:00
db:	JVNDB	id:	JVNDB-2022-010793	date:	2023-08-17T00:00:00
db:	CNNVD	id:	CNNVD-202205-2114	date:	2022-05-04T00:00:00
db:	NVD	id:	CVE-2022-25946	date:	2022-05-05T17:15:11.017