Sign-up

ID

VAR-202302-0051


CVE

CVE-2023-22657


TITLE

F5OS-A  and  F5OS-C  Command injection vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2023-003162

DESCRIPTION

On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. F5OS-A and F5OS-C Contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2023-22657 // JVNDB: JVNDB-2023-003162 // VULHUB: VHN-451926 // VULMON: CVE-2023-22657

AFFECTED PRODUCTS

vendor:f5model:f5os-cscope:gteversion:1.3.0

Trust: 1.0

vendor:f5model:f5os-ascope:ltversion:1.3.0

Trust: 1.0

vendor:f5model:f5os-cscope:ltversion:1.5.0

Trust: 1.0

vendor:f5model:f5os-ascope:gteversion:1.2.0

Trust: 1.0

vendor:f5model:f5os-ascope: - version: -

Trust: 0.8

vendor:f5model:f5os-cscope:eqversion:1.3.0 that's all 1.5.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-003162 // NVD: CVE-2023-22657

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-22657
value: HIGH

Trust: 1.0

f5sirt@f5.com: CVE-2023-22657
value: HIGH

Trust: 1.0

NVD: CVE-2023-22657
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202302-089
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2023-22657
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

f5sirt@f5.com: CVE-2023-22657
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-22657
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-003162 // CNNVD: CNNVD-202302-089 // NVD: CVE-2023-22657 // NVD: CVE-2023-22657

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.1

problemtype:Command injection (CWE-77) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-451926 // JVNDB: JVNDB-2023-003162 // NVD: CVE-2023-22657

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202302-089

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202302-089

PATCH

title:K06345931url:https://my.f5.com/manage/s/article/K06345931

Trust: 0.8

title:F5 BIG-IP Fixes for command injection vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=224789

Trust: 0.6

title: - url:https://github.com/Live-Hack-CVE/CVE-2023-22657

Trust: 0.1

sources: VULMON: CVE-2023-22657 // JVNDB: JVNDB-2023-003162 // CNNVD: CNNVD-202302-089

EXTERNAL IDS

db:NVDid:CVE-2023-22657

Trust: 3.4

db:JVNDBid:JVNDB-2023-003162

Trust: 0.8

db:CNNVDid:CNNVD-202302-089

Trust: 0.6

db:VULHUBid:VHN-451926

Trust: 0.1

db:VULMONid:CVE-2023-22657

Trust: 0.1

sources: VULHUB: VHN-451926 // VULMON: CVE-2023-22657 // JVNDB: JVNDB-2023-003162 // CNNVD: CNNVD-202302-089 // NVD: CVE-2023-22657

REFERENCES

url:https://my.f5.com/manage/s/article/k06345931

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-22657

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2023-22657/

Trust: 0.6

url:https://github.com/live-hack-cve/cve-2023-22657

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-451926 // VULMON: CVE-2023-22657 // JVNDB: JVNDB-2023-003162 // CNNVD: CNNVD-202302-089 // NVD: CVE-2023-22657

SOURCES

db:VULHUBid:VHN-451926
db:VULMONid:CVE-2023-22657
db:JVNDBid:JVNDB-2023-003162
db:CNNVDid:CNNVD-202302-089
db:NVDid:CVE-2023-22657

LAST UPDATE DATE

2024-08-14T13:42:06.375000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-451926date:2023-02-10T00:00:00
db:VULMONid:CVE-2023-22657date:2023-02-01T00:00:00
db:JVNDBid:JVNDB-2023-003162date:2023-09-01T07:42:00
db:CNNVDid:CNNVD-202302-089date:2023-02-13T00:00:00
db:NVDid:CVE-2023-22657date:2023-11-07T04:07:12.750

SOURCES RELEASE DATE

db:VULHUBid:VHN-451926date:2023-02-01T00:00:00
db:VULMONid:CVE-2023-22657date:2023-02-01T00:00:00
db:JVNDBid:JVNDB-2023-003162date:2023-09-01T00:00:00
db:CNNVDid:CNNVD-202302-089date:2023-02-01T00:00:00
db:NVDid:CVE-2023-22657date:2023-02-01T18:15:11.600