VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2023/46xxx/CVE-2023-46747.json
T

265 lines
11 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"cveMetadata": {
"cveId": "CVE-2023-46747",
"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"state": "PUBLISHED",
"assignerShortName": "f5",
"dateReserved": "2023-10-25T18:51:34.198Z",
"datePublished": "2023-10-26T20:04:53.929Z",
"dateUpdated": "2025-10-21T23:05:33.431Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"All Modules"
],
"product": "BIG-IP",
"vendor": "F5",
"versions": [
{
"changes": [
{
"at": "Hotfix-BIGIP-17.1.0.3.0.75.4-ENG.iso",
"status": "unaffected"
},
{
"at": "Hotfix-BIGIP-17.1.1.0.2.6-ENG.iso",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "17.1.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "Hotfix-BIGIP-16.1.4.1.0.50.5-ENG.iso",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "16.1.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "Hotfix-BIGIP-15.1.10.2.0.44.2-ENG.iso",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "15.1.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "Hotfix-BIGIP-14.1.5.6.0.10.6-ENG.iso",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "14.1.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "Hotfix-BIGIP-13.1.5.1.0.20.2-ENG.iso",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "13.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "F5 acknowledges Thomas Hendrickson and Michael Weber of Praetorian Security, Inc. for bringing this issue to our attention and following the highest standards of coordinated disclosure."
}
],
"datePublic": "2023-10-26T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<div>Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.<span style=\"background-color: var(--wht);\">&nbsp;&nbsp;</span><span style=\"background-color: var(--wht);\">Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated</span></div></span>"
}
],
"value": "Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"shortName": "f5",
"dateUpdated": "2023-11-16T01:59:49.829Z"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://my.f5.com/manage/s/article/K000137353"
},
{
"url": "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html"
},
{
"url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BIG-IP Configuration utility unauthenticated remote code execution vulnerability",
"x_generator": {
"engine": "F5 SIRTBot v1.0"
}
},
"adp": [
{
"providerMetadata": {
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE",
"dateUpdated": "2024-08-02T20:53:21.594Z"
},
"title": "CVE Program Container",
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://my.f5.com/manage/s/article/K000137353"
},
{
"url": "http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html",
"tags": [
"x_transferred"
]
},
{
"url": "https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/",
"tags": [
"x_transferred"
]
}
]
},
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2023-46747",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-10T22:07:47.164316Z"
}
}
},
{
"other": {
"type": "kev",
"content": {
"dateAdded": "2023-10-31",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747"
}
}
}
],
"references": [
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46747",
"tags": [
"government-resource"
]
}
],
"timeline": [
{
"time": "2023-10-31T00:00:00.000Z",
"lang": "en",
"value": "CVE-2023-46747 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-10-21T23:05:33.431Z"
}
}
]
}
}
View Git Blame Copy Permalink