Details of VAR-202302-0082

ID

VAR-202302-0082

CVE

CVE-2023-22358

TITLE

BIG-IP Edge Client Windows Installer Vulnerability regarding uncontrolled search path elements in

Trust: 0.8

sources: JVNDB: JVNDB-2023-003166

DESCRIPTION

In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2023-22358 // JVNDB: JVNDB-2023-003166 // VULHUB: VHN-451922 // VULMON: CVE-2023-22358

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	15.1.8	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	13.1.5	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	17.0.0	Trust: 1.0
vendor:	f5	model:	big-ip edge	scope:	eq	version:	-	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lt	version:	17.0.0.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	14.1.5	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	14.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	16.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	7.2.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lt	version:	7.2.3.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	16.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	-	version:	-	Trust: 0.8
vendor:	f5	model:	big-ip edge client	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-003166 // NVD: CVE-2023-22358

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-22358
value:	HIGH
Trust: 1.0
f5sirt@f5.com:	CVE-2023-22358
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2023-003166
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202302-093
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2023-22358
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 2.0
OTHER:	JVNDB-2023-003166
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-003166 // CNNVD: CNNVD-202302-093 // NVD: CVE-2023-22358 // NVD: CVE-2023-22358

PROBLEMTYPE DATA

problemtype:	CWE-427	Trust: 1.1
problemtype:	Uncontrolled search path elements (CWE-427) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-451922 // JVNDB: JVNDB-2023-003166 // NVD: CVE-2023-22358

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202302-093

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202302-093

PATCH

title:	K76964818	url:	https://my.f5.com/manage/s/article/K76964818	Trust: 0.8
title:	F5 BIG-IP Fixes for code issue vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=224511	Trust: 0.6
title:	-	url:	https://github.com/Live-Hack-CVE/CVE-2023-22358	Trust: 0.1

sources: VULMON: CVE-2023-22358 // JVNDB: JVNDB-2023-003166 // CNNVD: CNNVD-202302-093

EXTERNAL IDS

db:	NVD	id:	CVE-2023-22358	Trust: 3.4
db:	JVNDB	id:	JVNDB-2023-003166	Trust: 0.8
db:	AUSCERT	id:	ESB-2023.0639	Trust: 0.6
db:	CNNVD	id:	CNNVD-202302-093	Trust: 0.6
db:	VULHUB	id:	VHN-451922	Trust: 0.1
db:	VULMON	id:	CVE-2023-22358	Trust: 0.1

sources: VULHUB: VHN-451922 // VULMON: CVE-2023-22358 // JVNDB: JVNDB-2023-003166 // CNNVD: CNNVD-202302-093 // NVD: CVE-2023-22358

REFERENCES

url:	https://my.f5.com/manage/s/article/k76964818	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-22358	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2023.0639	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2023-22358/	Trust: 0.6
url:	https://github.com/live-hack-cve/cve-2023-22358	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-451922 // VULMON: CVE-2023-22358 // JVNDB: JVNDB-2023-003166 // CNNVD: CNNVD-202302-093 // NVD: CVE-2023-22358

SOURCES

db:	VULHUB	id:	VHN-451922
db:	VULMON	id:	CVE-2023-22358
db:	JVNDB	id:	JVNDB-2023-003166
db:	CNNVD	id:	CNNVD-202302-093
db:	NVD	id:	CVE-2023-22358

LAST UPDATE DATE

2024-08-14T15:05:54.928000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-451922	date:	2023-02-09T00:00:00
db:	VULMON	id:	CVE-2023-22358	date:	2023-02-01T00:00:00
db:	JVNDB	id:	JVNDB-2023-003166	date:	2023-09-01T07:52:00
db:	CNNVD	id:	CNNVD-202302-093	date:	2023-02-10T00:00:00
db:	NVD	id:	CVE-2023-22358	date:	2023-11-07T04:06:51.727

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-451922	date:	2023-02-01T00:00:00
db:	VULMON	id:	CVE-2023-22358	date:	2023-02-01T00:00:00
db:	JVNDB	id:	JVNDB-2023-003166	date:	2023-09-01T00:00:00
db:	CNNVD	id:	CNNVD-202302-093	date:	2023-02-01T00:00:00
db:	NVD	id:	CVE-2023-22358	date:	2023-02-01T18:15:11.247