CVE-2022-29263
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
F5 BIG-IP APM and APM Clients have a vulnerability related to improper handling of temporary files by the Edge Client Component Installer Service. Affected versions include 16.1.x before 16.1.2.2, 15.1.x before 15.1.5.1, 14.1.x before 14.1.4.6, 13.1.x before 13.1.5, all 12.1.x and 11.6.x, and APM Clients 7.x before 7.2.1.5.
Risk Assessment
The vulnerability could allow an attacker to manipulate temporary files, potentially leading to privilege escalation or unauthorized access.
Recommendation
Upgrade to patched versions or apply vendor-recommended mitigations.
Other vulnerabilities in F5 BIG-IP APM
See all- CVE-2017-6129High
In F5 BIG-IP APM software versions 13.0.0 and 12.1.2, under certain circumstances, tunneled VPN flows can lead to a VPN/PPP connflow being prematurely freed or cause TMM to stop responding with a 'flow not in use' assertion.
- CVE-2017-0301High
In F5 BIG-IP APM software versions 11.5.0 to 12.1.2, there is an issue where BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources.
- CVE-2015-8098Critical
F5 BIG-IP APM versions 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 contain a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile.
Original NVD description (English source)
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Vulnerability data from NVD (NIST) · CISA KEV · EPSS