CVE-2023-22302 - Vulnerability Details

Vendors	Products
F5	Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics Big-ip Application Acceleration Manager Big-ip Application Security Manager Big-ip Ddos Hybrid Defender Big-ip Domain Name System Big-ip Fraud Protection Service Big-ip Link Controller Big-ip Local Traffic Manager Big-ip Policy Enforcement Manager Big-ip Ssl Orchestrator

Link	Providers
https://my.f5.com/manage/s/article/K58550078

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22302", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2023-01-13T06:43:46.174Z", "datePublished": "2023-02-01T17:53:19.320Z", "dateUpdated": "2025-03-26T15:58:24.750Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["All modules"], "product": "BIG-IP", "vendor": "F5", "versions": [{"lessThan": "17.0.0.2", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "16.1.3.3", "status": "affected", "version": "16.1.2.2", "versionType": "semver"}]}], "datePublic": "2023-02-01T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker\u2019s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br>"}], "value": "In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker\u2019s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "description": "CWE-772 Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2023-02-01T17:53:19.320Z"}, "references": [{"url": "https://my.f5.com/manage/s/article/K58550078"}], "source": {"discovery": "INTERNAL"}, "title": "BIG-IP HTTP profile vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:07:05.929Z"}, "title": "CVE Program Container", "references": [{"url": "https://my.f5.com/manage/s/article/K58550078", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T15:57:36.687331Z", "id": "CVE-2023-22302", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T15:58:24.750Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-22302 (string)

assignerOrgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

state : PUBLISHED (string)

assignerShortName : f5 (string)

dateReserved : 2023-01-13T06:43:46.174Z (string)

datePublished : 2023-02-01T17:53:19.320Z (string)

dateUpdated : 2025-03-26T15:58:24.750Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unknown (string)

modules : [ »

0 : All modules (string)

]

product : BIG-IP (string)

vendor : F5 (string)

versions : [ »

0 : { »

lessThan : 17.0.0.2 (string)

status : affected (string)

version : 17.0.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 16.1.3.3 (string)

status : affected (string)

version : 16.1.2.2 (string)

versionType : semver (string)

}

]

}

]

datePublic : 2023-02-01T15:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br> (string)

}

]

value : In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-772 (string)

description : CWE-772 Missing Release of Resource after Effective Lifetime (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

shortName : f5 (string)

dateUpdated : 2023-02-01T17:53:19.320Z (string)

}

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K58550078 (string)

}

]

source : { »

discovery : INTERNAL (string)

}

title : BIG-IP HTTP profile vulnerability (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:07:05.929Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K58550078 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-26T15:57:36.687331Z (string)

id : CVE-2023-22302 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-26T15:58:24.750Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://my.f5.com/manage/s/article/K58550078", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:07:05.929Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22302", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T15:57:36.687331Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T15:57:43.913Z"}}], "cna": {"title": "BIG-IP HTTP profile vulnerability", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "F5", "modules": ["All modules"], "product": "BIG-IP", "versions": [{"status": "affected", "version": "17.0.0", "lessThan": "17.0.0.2", "versionType": "semver"}, {"status": "affected", "version": "16.1.2.2", "lessThan": "16.1.3.3", "versionType": "semver"}], "defaultStatus": "unknown"}], "datePublic": "2023-02-01T15:00:00.000Z", "references": [{"url": "https://my.f5.com/manage/s/article/K58550078"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker\u2019s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n", "supportingMedia": [{"type": "text/html", "value": "In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker\u2019s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772 Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2023-02-01T17:53:19.320Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22302", "state": "PUBLISHED", "dateUpdated": "2025-03-26T15:58:24.750Z", "dateReserved": "2023-01-13T06:43:46.174Z", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "datePublished": "2023-02-01T17:53:19.320Z", "assignerShortName": "f5"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K58550078 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:07:05.929Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-22302 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-26T15:57:36.687331Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-26T15:57:43.913Z (string)

}

]

cna : { »

title : BIG-IP HTTP profile vulnerability (string)

source : { »

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.9 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : F5 (string)

modules : [ »

0 : All modules (string)

]

product : BIG-IP (string)

versions : [ »

0 : { »

status : affected (string)

version : 17.0.0 (string)

lessThan : 17.0.0.2 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 16.1.2.2 (string)

lessThan : 16.1.3.3 (string)

versionType : semver (string)

}

]

defaultStatus : unknown (string)

}

]

datePublic : 2023-02-01T15:00:00.000Z (string)

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K58550078 (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-772 (string)

description : CWE-772 Missing Release of Resource after Effective Lifetime (string)

}

]

}

]

providerMetadata : { »

orgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

shortName : f5 (string)

dateUpdated : 2023-02-01T17:53:19.320Z (string)

}

cveMetadata : { »

cveId : CVE-2023-22302 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-26T15:58:24.750Z (string)

dateReserved : 2023-01-13T06:43:46.174Z (string)

assignerOrgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

datePublished : 2023-02-01T17:53:19.320Z (string)

assignerShortName : f5 (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B18C60C-27E7-4258-83B9-6972562E788B", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "E84986CC-EF54-4404-B559-3FF946C67BB0", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C2BE12E-5276-4589-9233-8B34501650B8", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D73AB87-F4A4-47D5-A21E-BB1330454634", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "51E21925-F4CE-4205-A217-18E5BE0C75AA", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2E0F084-A550-40EC-A106-D869DDA96546", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "B76DADBB-44CE-4729-B2C6-092C339EC7F4", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E9D2DF2-F179-4F04-AB09-1BEAD56248A6", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "264B4CF6-E013-46E6-A6FA-58B7D8A4A26A", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD5FB958-EDC9-4D39-AE1E-9E77FB5437B4", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE7B7358-8E75-4070-A426-8D883B25E384", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "33C4B785-93AC-4316-BDA1-D173520306E7", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "F09EA8D1-1230-44E0-8AD7-2EF57C335C80", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "93721140-2035-4431-BF5F-CA0C78BBFE53", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "63F2F61C-D9E2-4968-A854-FA802D96656F", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FACDA44-7199-47C7-A0C6-1728B46CC6AD", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "065979A9-63DB-4DEB-A0A7-454733EFC45F", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "1ED20421-3E21-40B8-B1FB-68F910F543F8", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "0941C38C-2BF4-4532-A4E2-4549823026A1", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FAB540A-6082-4F6E-9CDE-0AB719B1001F", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A23C109-279D-4015-9EBD-47D54DDEA0D7", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE38066A-9FAF-46E6-B3F8-1473D64EE122", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9E33213-C376-4CFF-9156-80FDBC945ABC", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "68A413B5-6809-4FB3-BAEC-5EF1FDF201B0", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker\u2019s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n"}], "id": "CVE-2023-22302", "lastModified": "2024-11-21T07:44:29.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "f5sirt@f5.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-01T18:15:10.820", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K58550078"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K58550078"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "f5sirt@f5.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-772"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3B18C60C-27E7-4258-83B9-6972562E788B (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E84986CC-EF54-4404-B559-3FF946C67BB0 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 0C2BE12E-5276-4589-9233-8B34501650B8 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4D73AB87-F4A4-47D5-A21E-BB1330454634 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 51E21925-F4CE-4205-A217-18E5BE0C75AA (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A2E0F084-A550-40EC-A106-D869DDA96546 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B76DADBB-44CE-4729-B2C6-092C339EC7F4 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7E9D2DF2-F179-4F04-AB09-1BEAD56248A6 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 264B4CF6-E013-46E6-A6FA-58B7D8A4A26A (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FD5FB958-EDC9-4D39-AE1E-9E77FB5437B4 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CE7B7358-8E75-4070-A426-8D883B25E384 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 33C4B785-93AC-4316-BDA1-D173520306E7 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F09EA8D1-1230-44E0-8AD7-2EF57C335C80 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 93721140-2035-4431-BF5F-CA0C78BBFE53 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 63F2F61C-D9E2-4968-A854-FA802D96656F (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1FACDA44-7199-47C7-A0C6-1728B46CC6AD (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 065979A9-63DB-4DEB-A0A7-454733EFC45F (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1ED20421-3E21-40B8-B1FB-68F910F543F8 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 0941C38C-2BF4-4532-A4E2-4549823026A1 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5FAB540A-6082-4F6E-9CDE-0AB719B1001F (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8A23C109-279D-4015-9EBD-47D54DDEA0D7 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : AE38066A-9FAF-46E6-B3F8-1473D64EE122 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B9E33213-C376-4CFF-9156-80FDBC945ABC (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.2.2 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 68A413B5-6809-4FB3-BAEC-5EF1FDF201B0 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : In BIG-IP versions 17.0.x before 17.0.0.2, and 16.1.x beginning in 16.1.2.2 to before 16.1.3.3, when an HTTP profile is configured on a virtual server and conditions beyond the attacker’s control exist on the target pool member, undisclosed requests sent to the BIG-IP system can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (string)

}

]

id : CVE-2023-22302 (string)

lastModified : 2024-11-21T07:44:29.253 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 3.6 (number)

source : f5sirt@f5.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-02-01T18:15:10.820 (string)

references : [ »

0 : { »

source : f5sirt@f5.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://my.f5.com/manage/s/article/K58550078 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://my.f5.com/manage/s/article/K58550078 (string)

}

]

sourceIdentifier : f5sirt@f5.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-772 (string)

}

]

source : f5sirt@f5.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-772 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object