Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
High
Attack Vector
Network
0

CVE-2022-25946

Disclosure Date: May 04, 2022
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, when running in Appliance mode, an authenticated attacker with Administrator role privilege may be able to bypass Appliance mode restrictions due to a missing integrity check in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
6.5 Medium
Impact Score:
5.2
Exploitability Score:
1.2
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
None

General Information

Vendors

  • f5

Products

  • big-ip access policy manager 13.1.0,
  • big-ip access policy manager 13.1.1,
  • big-ip access policy manager 13.1.3,
  • big-ip access policy manager 13.1.4,
  • big-ip access policy manager 13.1.5,
  • big-ip access policy manager 14.1.0,
  • big-ip access policy manager 14.1.2,
  • big-ip access policy manager 14.1.3,
  • big-ip access policy manager 14.1.4,
  • big-ip access policy manager 15.1.0,
  • big-ip access policy manager 15.1.1,
  • big-ip access policy manager 15.1.2,
  • big-ip access policy manager 15.1.3,
  • big-ip access policy manager 15.1.4,
  • big-ip access policy manager 15.1.5,
  • big-ip access policy manager 16.1.0,
  • big-ip access policy manager 16.1.1,
  • big-ip access policy manager 16.1.2,
  • big-ip advanced web application firewall 13.1.0,
  • big-ip advanced web application firewall 13.1.1,
  • big-ip advanced web application firewall 13.1.3,
  • big-ip advanced web application firewall 13.1.4,
  • big-ip advanced web application firewall 13.1.5,
  • big-ip advanced web application firewall 14.1.0,
  • big-ip advanced web application firewall 14.1.2,
  • big-ip advanced web application firewall 14.1.3,
  • big-ip advanced web application firewall 14.1.4,
  • big-ip advanced web application firewall 15.1.0,
  • big-ip advanced web application firewall 15.1.1,
  • big-ip advanced web application firewall 15.1.2,
  • big-ip advanced web application firewall 15.1.3,
  • big-ip advanced web application firewall 15.1.4,
  • big-ip advanced web application firewall 15.1.5,
  • big-ip advanced web application firewall 16.1.0,
  • big-ip advanced web application firewall 16.1.1,
  • big-ip advanced web application firewall 16.1.2,
  • big-ip application security manager 13.1.0,
  • big-ip application security manager 13.1.1,
  • big-ip application security manager 13.1.3,
  • big-ip application security manager 13.1.4,
  • big-ip application security manager 13.1.5,
  • big-ip application security manager 14.1.0,
  • big-ip application security manager 14.1.2,
  • big-ip application security manager 14.1.3,
  • big-ip application security manager 14.1.4,
  • big-ip application security manager 15.1.0,
  • big-ip application security manager 15.1.1,
  • big-ip application security manager 15.1.2,
  • big-ip application security manager 15.1.3,
  • big-ip application security manager 15.1.4,
  • big-ip application security manager 15.1.5,
  • big-ip application security manager 16.1.0,
  • big-ip application security manager 16.1.1,
  • big-ip application security manager 16.1.2,
  • big-ip guided configuration

Additional Info

Technical Analysis