f5 big-ip-access-policy-manager CVE-2023-46748 vulnerability in F5 Networks Products
Published on October 26, 2023

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Vendor Advisory NVD

Known Exploited Vulnerability

This F5 BIG-IP Configuration Utility SQL Injection Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

The following remediation steps are recommended / required by November 21, 2023: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vulnerability Analysis

CVE-2023-46748 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is a SQL Injection Vulnerability?

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE-2023-46748 has been classified to as a SQL Injection vulnerability or weakness.


Products Associated with CVE-2023-46748

You can be notified by stack.watch whenever vulnerabilities like CVE-2023-46748 are published in these products:

F5 Networks Big Ip Access Policy Manager
 
F5 Networks Big Ip Advanced Firewall Manager
 
F5 Networks Big Ip Carrier Grade Nat
 
F5 Networks Big Ip Ddos Hybrid Defender
 
F5 Networks Big Ip Ssl Orchestrator
 
F5 Networks Big Ip Local Traffic Manager
 
F5 Networks Big Ip Policy Enforcement Manager
 
F5 Networks Big Ip Automation Toolchain
 
F5 Networks Big Ip Container Ingress Services
 
F5 Networks Big Ip Advanced Web Application Firewall
 
F5 Networks Big Ip Domain Name System
 
F5 Networks Big Ip Application Security Manager
 
F5 Networks Big Ip Analytics
 
F5 Networks Big Ip Application Acceleration Manager
 
F5 Networks Big Ip Application Visibility Reporting
 
F5 Networks Big Ip Fraud Protection Services
 
F5 Networks Big Ip Global Traffic Manager
 
F5 Networks Big Ip Link Controller
 
F5 Networks Big Ip Webaccelerator
 
F5 Networks Big Ip Websafe
 

What versions are vulnerable to CVE-2023-46748?