Vulnerability Description
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Advanced Firewall Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Carrier-Grade Nat | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Ddos Hybrid Defender | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Ssl Orchestrator | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Local Traffic Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Policy Enforcement Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Automation Toolchain | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Container Ingress Services | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Advanced Web Application Firewall | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Domain Name System | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Application Security Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Analytics | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Application Acceleration Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Application Visibility And Reporting | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Fraud Protection Services | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Global Traffic Manager | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Link Controller | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Webaccelerator | >= 13.1.0, <= 13.1.5 |
| F5 | Big-Ip Websafe | >= 13.1.0, <= 13.1.5 |
Related Weaknesses (CWE)
References
- https://my.f5.com/manage/s/article/K000137365Vendor Advisory
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-activExploitThird Party Advisory
- https://my.f5.com/manage/s/article/K000137365Vendor Advisory
- https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-activExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-US Government Resource
FAQ
What is CVE-2023-46748?
CVE-2023-46748 is a vulnerability with a CVSS score of 8.8 (HIGH). An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP ...
How severe is CVE-2023-46748?
CVE-2023-46748 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-46748?
Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Carrier-Grade Nat, F5 Big-Ip Ddos Hybrid Defender, F5 Big-Ip Ssl Orchestrator.