CVE-2023-22664 - Vulnerability Details

Vendors	Products
F5	Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics Big-ip Application Acceleration Manager Big-ip Application Security Manager Big-ip Ddos Hybrid Defender Big-ip Domain Name System Big-ip Fraud Protection Service Big-ip Link Controller Big-ip Local Traffic Manager Big-ip Policy Enforcement Manager Big-ip Service Proxy Big-ip Ssl Orchestrator

Link	Providers
https://my.f5.com/manage/s/article/K56676554

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-22664", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2023-01-13T06:43:37.176Z", "datePublished": "2023-02-01T17:56:15.585Z", "dateUpdated": "2025-03-26T17:48:59.560Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["All modules"], "product": "BIG-IP", "vendor": "F5", "versions": [{"lessThan": "17.0.0.2", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "16.1.3.3", "status": "affected", "version": "16.1.0", "versionType": "semver"}]}, {"defaultStatus": "unknown", "product": "BIG-IP SPK", "vendor": "F5", "versions": [{"lessThan": "*", "status": "affected", "version": "1.6.0", "versionType": "semver"}]}], "datePublic": "2023-02-01T15:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br>"}], "value": "On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2023-02-01T17:56:15.585Z"}, "references": [{"url": "https://my.f5.com/manage/s/article/K56676554"}], "source": {"discovery": "INTERNAL"}, "title": "BIG-IP HTTP/2 profile vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:49.717Z"}, "title": "CVE Program Container", "references": [{"url": "https://my.f5.com/manage/s/article/K56676554", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T17:48:50.458671Z", "id": "CVE-2023-22664", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T17:48:59.560Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-22664 (string)

assignerOrgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

state : PUBLISHED (string)

assignerShortName : f5 (string)

dateReserved : 2023-01-13T06:43:37.176Z (string)

datePublished : 2023-02-01T17:56:15.585Z (string)

dateUpdated : 2025-03-26T17:48:59.560Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unknown (string)

modules : [ »

0 : All modules (string)

]

product : BIG-IP (string)

vendor : F5 (string)

versions : [ »

0 : { »

lessThan : 17.0.0.2 (string)

status : affected (string)

version : 17.0.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 16.1.3.3 (string)

status : affected (string)

version : 16.1.0 (string)

versionType : semver (string)

}

]

}

1 : { »

defaultStatus : unknown (string)

product : BIG-IP SPK (string)

vendor : F5 (string)

versions : [ »

0 : { »

lessThan : * (string)

status : affected (string)

version : 1.6.0 (string)

versionType : semver (string)

}

]

}

]

datePublic : 2023-02-01T15:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br> (string)

}

]

value : On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-400 (string)

description : CWE-400 Uncontrolled Resource Consumption (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

shortName : f5 (string)

dateUpdated : 2023-02-01T17:56:15.585Z (string)

}

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K56676554 (string)

}

]

source : { »

discovery : INTERNAL (string)

}

title : BIG-IP HTTP/2 profile vulnerability (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:13:49.717Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K56676554 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-26T17:48:50.458671Z (string)

id : CVE-2023-22664 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-26T17:48:59.560Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://my.f5.com/manage/s/article/K56676554", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:13:49.717Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-22664", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T17:48:50.458671Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T17:48:55.899Z"}}], "cna": {"title": "BIG-IP HTTP/2 profile vulnerability", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "F5", "modules": ["All modules"], "product": "BIG-IP", "versions": [{"status": "affected", "version": "17.0.0", "lessThan": "17.0.0.2", "versionType": "semver"}, {"status": "affected", "version": "16.1.0", "lessThan": "16.1.3.3", "versionType": "semver"}], "defaultStatus": "unknown"}, {"vendor": "F5", "product": "BIG-IP SPK", "versions": [{"status": "affected", "version": "1.6.0", "lessThan": "*", "versionType": "semver"}], "defaultStatus": "unknown"}], "datePublic": "2023-02-01T15:00:00.000Z", "references": [{"url": "https://my.f5.com/manage/s/article/K56676554"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n", "supportingMedia": [{"type": "text/html", "value": "On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2023-02-01T17:56:15.585Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22664", "state": "PUBLISHED", "dateUpdated": "2025-03-26T17:48:59.560Z", "dateReserved": "2023-01-13T06:43:37.176Z", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "datePublished": "2023-02-01T17:56:15.585Z", "assignerShortName": "f5"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K56676554 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T10:13:49.717Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-22664 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-26T17:48:50.458671Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-26T17:48:55.899Z (string)

}

]

cna : { »

title : BIG-IP HTTP/2 profile vulnerability (string)

source : { »

discovery : INTERNAL (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : F5 (string)

modules : [ »

0 : All modules (string)

]

product : BIG-IP (string)

versions : [ »

0 : { »

status : affected (string)

version : 17.0.0 (string)

lessThan : 17.0.0.2 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 16.1.0 (string)

lessThan : 16.1.3.3 (string)

versionType : semver (string)

}

]

defaultStatus : unknown (string)

}

1 : { »

vendor : F5 (string)

product : BIG-IP SPK (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.6.0 (string)

lessThan : * (string)

versionType : semver (string)

}

]

defaultStatus : unknown (string)

}

]

datePublic : 2023-02-01T15:00:00.000Z (string)

references : [ »

0 : { »

url : https://my.f5.com/manage/s/article/K56676554 (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-400 (string)

description : CWE-400 Uncontrolled Resource Consumption (string)

}

]

}

]

providerMetadata : { »

orgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

shortName : f5 (string)

dateUpdated : 2023-02-01T17:56:15.585Z (string)

}

cveMetadata : { »

cveId : CVE-2023-22664 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-26T17:48:59.560Z (string)

dateReserved : 2023-01-13T06:43:37.176Z (string)

assignerOrgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

datePublished : 2023-02-01T17:56:15.585Z (string)

assignerShortName : f5 (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "E211EE8D-ED93-4B99-9DF3-C0A56E782749", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "E84986CC-EF54-4404-B559-3FF946C67BB0", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BE9E6C1-F19B-4379-96AA-A4C43FED6921", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D73AB87-F4A4-47D5-A21E-BB1330454634", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "F47748D7-BEF6-44B0-A748-6F5EF154A09E", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2E0F084-A550-40EC-A106-D869DDA96546", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8665197E-25F4-4EAC-A036-6EC313C69A48", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "7E9D2DF2-F179-4F04-AB09-1BEAD56248A6", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "28B27399-D55E-4321-9B25-4685AA643B10", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD5FB958-EDC9-4D39-AE1E-9E77FB5437B4", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "96DE97E1-4375-47BB-985C-4F9E8CCE829E", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*", "matchCriteriaId": "33C4B785-93AC-4316-BDA1-D173520306E7", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "203B2B00-7DA5-443D-B4AA-DE0814D7E04D", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "93721140-2035-4431-BF5F-CA0C78BBFE53", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "40526EBE-1BB9-4AF3-89E8-A76568DB6F63", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FACDA44-7199-47C7-A0C6-1728B46CC6AD", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1AEDD0E-C859-4946-9BF1-F9B2D5332789", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "1ED20421-3E21-40B8-B1FB-68F910F543F8", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "F11221E1-8354-4854-A75D-060721E9671F", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FAB540A-6082-4F6E-9CDE-0AB719B1001F", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EF26563-5CFC-45E3-84DC-73575B22A16C", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE38066A-9FAF-46E6-B3F8-1473D64EE122", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "635F85D5-C992-4C41-8B26-317DBCD2F2FC", "versionEndExcluding": "16.1.3.3", "versionStartIncluding": "16.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "68A413B5-6809-4FB3-BAEC-5EF1FDF201B0", "versionEndExcluding": "17.0.0.2", "versionStartIncluding": "17.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_service_proxy:1.6.0:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "BC5AC8C7-92BA-48D4-81A1-F5323DA952A9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n"}], "id": "CVE-2023-22664", "lastModified": "2024-11-21T07:45:09.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "f5sirt@f5.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-01T18:15:11.677", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K56676554"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://my.f5.com/manage/s/article/K56676554"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "f5sirt@f5.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E211EE8D-ED93-4B99-9DF3-C0A56E782749 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E84986CC-EF54-4404-B559-3FF946C67BB0 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2BE9E6C1-F19B-4379-96AA-A4C43FED6921 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4D73AB87-F4A4-47D5-A21E-BB1330454634 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F47748D7-BEF6-44B0-A748-6F5EF154A09E (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A2E0F084-A550-40EC-A106-D869DDA96546 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8665197E-25F4-4EAC-A036-6EC313C69A48 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7E9D2DF2-F179-4F04-AB09-1BEAD56248A6 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 28B27399-D55E-4321-9B25-4685AA643B10 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FD5FB958-EDC9-4D39-AE1E-9E77FB5437B4 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 96DE97E1-4375-47BB-985C-4F9E8CCE829E (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 33C4B785-93AC-4316-BDA1-D173520306E7 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 203B2B00-7DA5-443D-B4AA-DE0814D7E04D (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 93721140-2035-4431-BF5F-CA0C78BBFE53 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 40526EBE-1BB9-4AF3-89E8-A76568DB6F63 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1FACDA44-7199-47C7-A0C6-1728B46CC6AD (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : C1AEDD0E-C859-4946-9BF1-F9B2D5332789 (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1ED20421-3E21-40B8-B1FB-68F910F543F8 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : F11221E1-8354-4854-A75D-060721E9671F (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5FAB540A-6082-4F6E-9CDE-0AB719B1001F (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2EF26563-5CFC-45E3-84DC-73575B22A16C (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* (string)

matchCriteriaId : AE38066A-9FAF-46E6-B3F8-1473D64EE122 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 635F85D5-C992-4C41-8B26-317DBCD2F2FC (string)

versionEndExcluding : 16.1.3.3 (string)

versionStartIncluding : 16.1.0 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 68A413B5-6809-4FB3-BAEC-5EF1FDF201B0 (string)

versionEndExcluding : 17.0.0.2 (string)

versionStartIncluding : 17.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:f5:big-ip_service_proxy:1.6.0:*:*:*:*:kubernetes:*:* (string)

matchCriteriaId : BC5AC8C7-92BA-48D4-81A1-F5323DA952A9 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, and BIG-IP SPK starting in version 1.6.0, when a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (string)

}

]

id : CVE-2023-22664 (string)

lastModified : 2024-11-21T07:45:09.650 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : f5sirt@f5.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-02-01T18:15:11.677 (string)

references : [ »

0 : { »

source : f5sirt@f5.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://my.f5.com/manage/s/article/K56676554 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://my.f5.com/manage/s/article/K56676554 (string)

}

]

sourceIdentifier : f5sirt@f5.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-400 (string)

}

]

source : f5sirt@f5.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-400 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object