Vulnerability Details : CVE-2023-22283
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Products affected by CVE-2023-22283
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 16.1.0 and up to, including, (<=) 16.1.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy Manager » Clients EditionVersions from including (>=) 7.2.2 and before (<) 7.2.3.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:clients:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 15.1.0 and up to, including, (<=) 15.1.8cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:f5:big-ip_edge:-:*:*:*:clients:windows:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-22283
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 13 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-22283
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.3
|
MEDIUM | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H |
0.3
|
5.9
|
F5 Networks | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
0.6
|
5.9
|
F5 Networks | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
0.6
|
5.9
|
NIST |
CWE ids for CVE-2023-22283
-
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.Assigned by:
- f5sirt@f5.com (Primary)
- nvd@nist.gov (Secondary)
References for CVE-2023-22283
-
https://my.f5.com/manage/s/article/K07143733
BIG-IP Edge Client for Windows vulnerability CVE-2023-22283Vendor Advisory
Jump to