HIGH
BIG-IP Advanced WAF and ASM vulnerability
Published Feb 1, 2023
7.5
HIGHCVSS 3.1
EPSS 1.54%
Description
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.0 before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP Advanced WAF or BIG-IP ASM security policy is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
-
- Version 13.1.0StatusaffectedConstraints<*
- Version 14.1.0StatusaffectedConstraints<14.1.5.3
- Version 15.1.0StatusaffectedConstraints<15.1.8
- Version 16.1.0StatusaffectedConstraints<16.1.3.3
- Version 17.0.0StatusaffectedConstraints<17.0.0.2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
OR
- ≥ 13.1.0 · ≤ 13.1.5
- ≥ 14.1.0 · < 14.1.5.3
- ≥ 15.1.0 · < 15.1.8
- ≥ 16.1.0 · < 16.1.3.3
- ≥ 17.0.0 · < 17.0.0.2
- ≥ 13.1.0 · ≤ 13.1.5
- ≥ 14.1.0 · < 14.1.5.3
- ≥ 15.1.0 · < 15.1.8
- ≥ 16.1.0 · < 16.1.3.3
- ≥ 17.0.0 · < 17.0.0.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27652 Advisory
- https://my.f5.com/manage/s/article/K17542533 Vendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27652 | Advisory | |
| https://my.f5.com/manage/s/article/K17542533 | Vendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner f5
Published Feb 1, 2023
Updated Mar 25, 2025
Reserved Jan 13, 2023
Link CVE-2023-23552
CISA Vulnrichment
Updated Mar 25, 2025
ENISA EUVD
EUVD-2023-27652 Assigner f5
Published Feb 1, 2023
Updated Mar 25, 2025
Exploited since n/a
Link EUVD-2023-27652