f5 big-ip-access-policy-manager CVE-2022-1388 vulnerability in F5 Networks Products
Published on May 5, 2022

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Vendor Advisory NVD

Known Exploited Vulnerability

This F5 BIG-IP Missing Authentication Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

The following remediation steps are recommended / required by May 31, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2022-1388 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Missing Authentication for Critical Function

The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.


Products Associated with CVE-2022-1388

You can be notified by stack.watch whenever vulnerabilities like CVE-2022-1388 are published in these products:

F5 Networks Big Ip Access Policy Manager
 
F5 Networks Big Ip Advanced Firewall Manager
 
F5 Networks Big Ip Analytics
 
F5 Networks Big Ip Application Acceleration Manager
 
F5 Networks Big Ip Application Security Manager
 
F5 Networks Big Ip Domain Name System
 
F5 Networks Big Ip Fraud Protection Service
 
F5 Networks Big Ip Global Traffic Manager
 
F5 Networks Big Ip Link Controller
 
F5 Networks Big Ip Local Traffic Manager
 
F5 Networks Big Ip Policy Enforcement Manager
 

What versions are vulnerable to CVE-2022-1388?