CVE-2023-22283

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22283
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.6 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://my.f5.com/manage/s/article/K07143733 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:clients:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_edge:-:*:*:*:clients:windows:*:*
History

04 Oct 2023, 00:15

Type Values Removed Values Added
Summary On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

09 Feb 2023, 15:00

Type Values Removed Values Added
CPE cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:clients:*:*:*
cpe:2.3:a:f5:big-ip_edge:-:*:*:*:clients:windows:*:*
First Time F5
F5 big-ip Edge
F5 big-ip Access Policy Manager
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References (MISC) https://my.f5.com/manage/s/article/K07143733 - (MISC) https://my.f5.com/manage/s/article/K07143733 - Vendor Advisory
CWE CWE-427

01 Feb 2023, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-01 18:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-22283

Mitre link : CVE-2023-22283

CVE.ORG link : CVE-2023-22283

JSON object : View

Products Affected

f5

  • big-ip_edge
  • big-ip_access_policy_manager
CWE
CWE-427

Uncontrolled Search Path Element