CVE-2023-29240 - OpenCVE

An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
F5	Big-iq Centralized Management

Configuration 1 [-]

cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://my.f5.com/manage/s/article/K000132719

History

No history.

MITRE

Status: PUBLISHED

Assigner: f5

Published: 2023-05-03T14:35:03.436Z

Updated: 2024-08-02T14:00:16.014Z

Reserved: 2023-04-14T23:08:02.594Z

Link: CVE-2023-29240

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-05-03T15:15:13.423

Modified: 2023-05-10T19:44:38.630

Link: CVE-2023-29240

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29240", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2023-04-14T23:08:02.594Z", "datePublished": "2023-05-03T14:35:03.436Z", "dateUpdated": "2024-08-02T14:00:16.014Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Centralized Management"], "product": "BIG-IQ", "vendor": "F5", "versions": [{"lessThan": "8.3.0", "status": "affected", "version": "8.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "F5 acknowledges Mateusz D\u0105browski of ING for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2023-05-03T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.</span>  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "\nAn authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2023-05-03T14:35:03.436Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://my.f5.com/manage/s/article/K000132719"}], "source": {"discovery": "EXTERNAL"}, "title": "BIG-IQ iControl REST Vulnerability", "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:00:16.014Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://my.f5.com/manage/s/article/K000132719"}]}]}}