CVE-2022-23009 - On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system

Back Back to CVE browser

HIGH

On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system

Published Jan 25, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.11%

Description

On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Vendor n/a Product BIG-IQ Centralized Management Default
n/a
- Version
  8.x before 8.1.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

BIG-IQ Centralized Management

n/a

Version	Status	Constraints
8.x before 8.1.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28120
Advisory
https://support.f5.com/csp/article/K47592780
x_refsource_MISCMitigationVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28120		Advisory
https://support.f5.com/csp/article/K47592780		x_refsource_MISCMitigationVendor Advisory