CVE-2022-23031

CVE	CVE-2022-23031
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-01-25 20:15:00 UTC
Updated	2022-02-01 19:11:00 UTC
Description	On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Problem Types: CWE-611

Type	Vendor	Product	Version	Update	Edition	Language
Application	F5	Big-ip Advanced Web Application Firewall	All	All	All	All
Application	F5	Big-ip Advanced Web Application Firewall	All	All	All	All
Application	F5	Big-ip Advanced Web Application Firewall	All	All	All	All
Application	F5	Big-ip Application Security Manager	All	All	All	All
Application	F5	Big-ip Application Security Manager	All	All	All	All
Application	F5	Big-ip Application Security Manager	All	All	All	All
Application	F5	Big-ip Fraud Protection Service	All	All	All	All
Application	F5	Big-ip Fraud Protection Service	All	All	All	All
Application	F5	Big-ip Fraud Protection Service	All	All	All	All

Reference	Source	Link	Tags
support.f5.com/csp/article/K61112120	MISC	support.f5.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

376275 F5 BIG-IP Application Security Manager (ASM) and Advanced Web Application Firewall (WAF) Traffic Management User Interface (TMUI) Vulnerability (K61112120)
376290 F5 BIG-IP Application Security Manager (ASM) and Advanced Web Application Firewall (WAF) Traffic Management User Interface (TMUI) Vulnerability (K61112120)
376320 F5 BIG-IP Application Security Manager (ASM) and Advanced Web Application Firewall (WAF) Traffic Management User Interface (TMUI) Vulnerability (K61112120)
376338 F5 BIG-IP Application Security Manager (ASM) and Advanced Web Application Firewall (WAF) Traffic Management User Interface (TMUI) Vulnerability (K61112120)
376361 F5 BIG-IP Application Security Manager (ASM) and Advanced Web Application Firewall (WAF) Traffic Management User Interface (TMUI) Vulnerability (K61112120)