CVE-2023-28406

Summary

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

VendorProductVersion RangeStatus
F5BIG-IP17.1.0 < *unaffected
F5BIG-IP17.0.0 < *affected
F5BIG-IP16.1.0 < 16.1.3.4affected
F5BIG-IP15.1.0 < 15.1.8.2affected
F5BIG-IP14.1.0 < 14.1.5.4affected
F5BIG-IP13.1.0 < *affected

Weaknesses

  • CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References