CVE-2022-29263
Summary
| CVE | CVE-2022-29263 |
|---|---|
| State | PUBLISHED |
| Assigner | f5 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-05 17:15:14 UTC |
| Updated | 2026-10-08 22:17:20 UTC |
| Description | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.002080000 probability, percentile 0.103350000 (date 2026-10-24)
Problem Types: CWE-732 | CWE-732 CWE-732 Incorrect Permission Assignment for Critical Resource
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:L/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | F5 | Access Policy Manager Clients | 7.1.8 | All | All | All |
| Application | F5 | Access Policy Manager Clients | 7.1.8.5 | All | All | All |
| Application | F5 | Access Policy Manager Clients | 7.1.9 | All | All | All |
| Application | F5 | Access Policy Manager Clients | 7.1.9.7 | All | All | All |
| Application | F5 | Access Policy Manager Clients | 7.1.9.8 | All | All | All |
| Application | F5 | Access Policy Manager Clients | 7.2.1 | All | All | All |
| Application | F5 | Access Policy Manager Clients | 7.2.1.1 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 11.6.1 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 11.6.2 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 11.6.3 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 11.6.4 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 11.6.5 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.0 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.1 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.2 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.3 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.4 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.5 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 12.1.6 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 13.1.0 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 13.1.1 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 13.1.3 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 13.1.4 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 13.1.5 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 14.1.0 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 14.1.2 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 14.1.3 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 14.1.4 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 15.1.0 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 15.1.1 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 15.1.2 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 15.1.3 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 15.1.4 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 15.1.5 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 16.1.0 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 16.1.1 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 16.1.2 | All | All | All |
| Application | F5 | Big-ip Access Policy Manager | 17.0.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | F5 | BIG-IP APM | affected 12.1.x | Not specified |
| CNA | F5 | BIG-IP APM | affected 11.6.x | Not specified |
| CNA | F5 | BIG-IP APM | unaffected 17.0.0 17.0.x* custom | Not specified |
| CNA | F5 | BIG-IP APM | affected 16.1.x 16.1.2.2 custom | Not specified |
| CNA | F5 | BIG-IP APM | affected 15.1.x 15.1.5.1 custom | Not specified |
| CNA | F5 | BIG-IP APM | affected 14.1.x 14.1.4.6 custom | Not specified |
| CNA | F5 | BIG-IP APM | affected 13.1.x 13.1.5 custom | Not specified |
| CNA | F5 | BIG-IP APM Clients | affected 7.x 7.2.1.5 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| support.f5.com/csp/article/K33552735 | af854a3a-2127-422b-91ae-364da2661108 | support.f5.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 376595 F5 BIG-IP Access Policy Manager (APM) Privilege Escalation Vulnerability (K33552735)