Detections
Analytics
F5 Networks BIG-IP : BIG-IP APM vulnerability (K93543114)
medium Nessus Plugin ID 160548
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5 / 14.1.4.6 / 15.1.5.1 / 16.1.2.2 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K93543114 advisory.- On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when APM is configured on a virtual server and the associated access profile is configured with APM AAA NTLM Auth, undisclosed requests can cause an increase in internal resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated (CVE-2022-27181)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to one of the non-vulnerable versions listed in the F5 Solution K93543114.See Also
Plugin Details
Severity: Medium
ID: 160548
File Name: f5_bigip_SOL93543114.nasl
Version: 1.7
Type: local
Published: 5/5/2022
Updated: 5/10/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 1.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2022-27181
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/h:f5:big-ip
Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version
Exploit Ease: No known exploits are available
Patch Publication Date: 5/4/2022
Vulnerability Publication Date: 5/4/2022
Reference Information
CVE: CVE-2022-27181
IAVA: 2022-A-0189-S