Skip to content
fr Sign in
7.2 High

CVE-2022-28695 On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to…

Description

On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows an attacker to run arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products and versions

Product Affected versions Fixed in
BIG-IP AFM 17.0 earliest → < 17.0.0 17.0.0
BIG-IP AFM 16.1 16.1.x → < 16.1.2.2 16.1.2.2
BIG-IP AFM 15.1 15.1.x → < 15.1.5.1 15.1.5.1
BIG-IP AFM 14.1 14.1.x → < 14.1.4.6 14.1.4.6
BIG-IP AFM 13.1 13.1.x → < 13.1.5 13.1.5
BIG-IP AFM 12.1 earliest → < 12.1.x 12.1.x
BIG-IP AFM 11.6 earliest → < 11.6.x 11.6.x

References

Timeline

  1. Published
  2. Last modified

Other CVEs of BIG-IP AFM

The 3 CVEs of BIG-IP AFM →
CVE-2022-41806 In versions 16.1.x before 16.1.3.2 and 15.1.x before 15.1.5.1, when BIG-IP AFM Network Address Translation policy with… 7.5 High CVE-2019-6672 On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard… Not rated
Track this CVE