CVE-2022-23013
Published Jan 25, 2022
Last updated 3 years ago
Overview
- Description
- On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Source
- f5sirt@f5.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 4.3
- Impact score
- 2.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:N/I:P/A:N
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "678A0B9C-8DF1-4380-9E12-D3A3973DE2AC",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8B9C544-46AA-42EE-BDC0-7C21F0A266F2",
"versionEndIncluding": "12.1.6",
"versionStartIncluding": "12.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99C43394-83EA-48C8-A129-9F7AB9218267",
"versionEndIncluding": "13.1.4",
"versionStartIncluding": "13.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CEA61DA-7C5A-44AB-95E2-3B1EFD4ABD5A",
"versionEndExcluding": "14.1.4.4",
"versionStartIncluding": "14.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C8322730-8A09-4BC4-8FDD-29CC799BBED0",
"versionEndExcluding": "15.1.4",
"versionStartIncluding": "15.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B482DB60-D251-4478-83C9-073EE0759BF4",
"versionEndExcluding": "16.1.0",
"versionStartIncluding": "16.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "285E9090-E35E-4796-BD25-C06A793B26BF",
"versionEndIncluding": "11.6.5",
"versionStartIncluding": "11.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "038F2D0F-EBD4-48C6-A1BB-E32B469E5FA9",
"versionEndIncluding": "12.1.6",
"versionStartIncluding": "12.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BF33A2D-839D-4A8F-95A8-09B0F80921F9",
"versionEndIncluding": "13.1.4",
"versionStartIncluding": "13.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BC37431-92C5-414A-B960-D3D9423C0B5C",
"versionEndExcluding": "14.1.4.4",
"versionStartIncluding": "14.0.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD9541A9-35D6-4349-817C-E32743A0F4FB",
"versionEndExcluding": "15.1.4",
"versionStartIncluding": "15.1.0"
},
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A701279F-6D0E-4282-AB53-B65F199BCDE3",
"versionEndExcluding": "16.1.0",
"versionStartIncluding": "16.0.0"
}
],
"operator": "OR"
}
]
}
]