All the vulnerabilites related to F5 - BIG-IP Next CNF
cve-2024-23306
Vulnerability from cvelistv5
Published
2024-02-14 16:30
Modified
2024-08-01 22:59
Severity ?
EPSS score ?
Summary
BIG-IP Next CNF & SPK vulnerability
References
▼ | URL | Tags |
---|---|---|
https://my.f5.com/manage/s/article/K000137886 | vendor-advisory |
Impacted products
Vendor | Product | Version | |||||
---|---|---|---|---|---|---|---|
▼ | F5 | BIG-IP Next SPK |
Version: 1.3.0 < 1.5.0 |
||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-23306", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-02-21T20:31:33.169264Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:46:11.754Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T22:59:32.236Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://my.f5.com/manage/s/article/K000137886" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "BIG-IP Next SPK", "vendor": "F5", "versions": [ { "lessThan": "1.5.0", "status": "affected", "version": "1.3.0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "BIG-IP Next CNF", "vendor": "F5", "versions": [ { "lessThan": "1.2.0", "status": "affected", "version": "1.0.0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "F5" } ], "datePublic": "2024-02-14T15:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files.\u003c/span\u003e\u0026nbsp; Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated" } ], "value": "\nA vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-02-14T17:29:14.631Z", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://my.f5.com/manage/s/article/K000137886" } ], "source": { "discovery": "INTERNAL" }, "title": "BIG-IP Next CNF \u0026 SPK vulnerability", "x_generator": { "engine": "F5 SIRTBot v1.0" } } }, "cveMetadata": { "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2024-23306", "datePublished": "2024-02-14T16:30:23.515Z", "dateReserved": "2024-02-01T22:13:58.485Z", "dateUpdated": "2024-08-01T22:59:32.236Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-28132
Vulnerability from cvelistv5
Published
2024-05-08 15:01
Modified
2024-08-02 00:48
Severity ?
EPSS score ?
Summary
BIG-IP NEXT CNF vulnerability
References
▼ | URL | Tags |
---|---|---|
https://my.f5.com/manage/s/article/K000138913 | vendor-advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | F5 | BIG-IP Next CNF |
Version: 1.2.0 < 1.3.0 |
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-28132", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-09T18:16:57.699411Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T18:03:34.871Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T00:48:49.036Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://my.f5.com/manage/s/article/K000138913" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "product": "BIG-IP Next CNF", "vendor": "F5", "versions": [ { "lessThan": "1.3.0", "status": "affected", "version": "1.2.0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "F5" } ], "datePublic": "2024-05-08T14:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eExposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u0026nbsp;\u003c/span\u003eNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n\u003c/span\u003e\n\n" } ], "value": "\nExposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\n\n\n" } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-922", "description": "CWE-922 Insecure Storage of Sensitive Information", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-05-08T15:01:27.035Z", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://my.f5.com/manage/s/article/K000138913" } ], "source": { "discovery": "INTERNAL" }, "title": "BIG-IP NEXT CNF vulnerability ", "x_generator": { "engine": "F5 SIRTBot v1.0" } } }, "cveMetadata": { "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2024-28132", "datePublished": "2024-05-08T15:01:27.035Z", "dateReserved": "2024-04-24T21:34:20.669Z", "dateUpdated": "2024-08-02T00:48:49.036Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-41164
Vulnerability from cvelistv5
Published
2024-08-14 14:32
Modified
2024-08-14 14:53
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
EPSS score ?
Summary
BIG-IP MPTCP vulnerability
References
▼ | URL | Tags |
---|---|---|
https://my.f5.com/manage/s/article/K000138477 | vendor-advisory |
Impacted products
Vendor | Product | Version | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
▼ | F5 | BIG-IP |
Version: 17.1.0 < 17.1.1 Version: 16.1.0 < 16.1.5 Version: 15.1.0 < 15.1.10 |
||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-41164", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-14T14:53:05.338308Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-14T14:53:16.759Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "modules": [ "All Modules" ], "product": "BIG-IP", "vendor": "F5", "versions": [ { "lessThan": "17.1.1", "status": "affected", "version": "17.1.0", "versionType": "custom" }, { "lessThan": "16.1.5", "status": "affected", "version": "16.1.0", "versionType": "custom" }, { "lessThan": "15.1.10", "status": "affected", "version": "15.1.0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "BIG-IP Next CNF", "vendor": "F5", "versions": [ { "lessThan": "1.2.0", "status": "affected", "version": "1.1.0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "BIG-IP Next SPK", "vendor": "F5", "versions": [ { "lessThan": "1.9.0", "status": "affected", "version": "1.5.0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "F5" } ], "datePublic": "2024-08-14T14:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate.\u003c/span\u003e\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated." } ], "value": "When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-14T14:32:31.623Z", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://my.f5.com/manage/s/article/K000138477" } ], "source": { "discovery": "INTERNAL" }, "title": "BIG-IP MPTCP vulnerability", "x_generator": { "engine": "F5 SIRTBot v1.0" } } }, "cveMetadata": { "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2024-41164", "datePublished": "2024-08-14T14:32:31.623Z", "dateReserved": "2024-07-22T19:43:52.831Z", "dateUpdated": "2024-08-14T14:53:16.759Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-25560
Vulnerability from cvelistv5
Published
2024-05-08 15:01
Modified
2024-08-01 23:44
Severity ?
EPSS score ?
Summary
TMM Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://my.f5.com/manage/s/article/K000139037 | vendor-advisory |
Impacted products
Vendor | Product | Version | |||||
---|---|---|---|---|---|---|---|
▼ | F5 | BIG-IP |
Version: 17.1.0 < 17.1.1 Version: 16.1.0 < 16.1.4 Version: 15.1.0 < * |
||||
|
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:1.1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "big-ip_next_cloud-native_network_functions", "vendor": "f5", "versions": [ { "lessThan": "1.2.0", "status": "affected", "version": "1.1.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:f5:big-ip:17.1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "big-ip", "vendor": "f5", "versions": [ { "lessThan": "17.1.1", "status": "affected", "version": "17.1.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:f5:big-ip:16.1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "big-ip", "vendor": "f5", "versions": [ { "lessThan": "16.1.4", "status": "affected", "version": "16.1.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:f5:big-ip:15.1.0:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "big-ip", "vendor": "f5", "versions": [ { "lessThan": "*", "status": "affected", "version": "15.1.0", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-25560", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-08T15:54:52.945502Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-23T21:02:12.590Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T23:44:09.627Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://my.f5.com/manage/s/article/K000139037" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "unknown", "modules": [ "AFM" ], "product": "BIG-IP", "vendor": "F5", "versions": [ { "lessThan": "17.1.1", "status": "affected", "version": "17.1.0", "versionType": "custom" }, { "lessThan": "16.1.4", "status": "affected", "version": "16.1.0", "versionType": "custom" }, { "lessThan": "*", "status": "affected", "version": "15.1.0", "versionType": "custom" } ] }, { "defaultStatus": "unknown", "product": "BIG-IP Next CNF", "vendor": "F5", "versions": [ { "lessThan": "1.2.0", "status": "affected", "version": "1.1.0", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "F5" } ], "datePublic": "2024-05-08T14:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate.\u003c/span\u003e\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated." } ], "value": "\nWhen BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-05-08T15:01:25.651Z", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://my.f5.com/manage/s/article/K000139037" } ], "source": { "discovery": "INTERNAL" }, "title": "TMM Vulnerability", "x_generator": { "engine": "F5 SIRTBot v1.0" } } }, "cveMetadata": { "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2024-25560", "datePublished": "2024-05-08T15:01:25.651Z", "dateReserved": "2024-04-24T21:34:20.655Z", "dateUpdated": "2024-08-01T23:44:09.627Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }