CVE-2023-29240

Summary

An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

Weaknesses

• CWE-863: CWE-863 Incorrect Authorization

ADP Enrichment

CVE Program Container

Additional References

• https://my.f5.com/manage/s/article/K000132719

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://my.f5.com/manage/s/article/K000132719

• ←Previous
• Next→