Skip to content
fr Sign in
6.5 Medium

CVE-2022-27634 On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate…

Description

On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products and versions

Product Affected versions Fixed in
BIG-IP APM 17.0 earliest → < 17.0.0 17.0.0
BIG-IP APM 16.1 16.1.x → < 16.1.2.2 16.1.2.2
BIG-IP APM 15.1 15.1.x → < 15.1.5.1 15.1.5.1
BIG-IP APM 14.1 earliest → < 14.1.x 14.1.x
BIG-IP APM 13.1 earliest → < 13.1.x 13.1.x
BIG-IP APM 12.1 earliest → < 12.1.x 12.1.x
BIG-IP APM 11.6 earliest → < 11.6.x 11.6.x

References

Timeline

  1. Published
  2. Last modified

Other CVEs of BIG-IP APM

The 12 CVEs of BIG-IP APM →
CVE-2022-35245 In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM… 7.5 High CVE-2022-33203 In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access… 7.5 High CVE-2022-31473 In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated… 6.8 Medium CVE-2022-29263 On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to… 7.8 High
Track this CVE