CVE-2023-24461 : An improper certificate validation vulnerability exists in the BIG-IP Edge Clie

An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published 2023-05-03 15:15:12

Updated 2023-05-10 18:29:52

Source F5 Networks

View at NVD, CVE.org

Products affected by CVE-2023-24461

F5 » Big-ip Access Policy Manager
Versions from including (>=) 17.0.0 and up to, including, (<=) 17.1.0
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
F5 » Big-ip Access Policy Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.3
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
F5 » Big-ip Access Policy Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
F5 » Big-ip Access Policy Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.8
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
F5 » Big-ip Access Policy Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
F5 » Big-ip Access Policy Manager
Versions from including (>=) 7.2.2 and before (<) 7.2.4.1
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-24461

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 25 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-24461

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.4	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	2.2	5.2	F5 Networks
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2023-24461

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: f5sirt@f5.com (Primary)

References for CVE-2023-24461

https://my.f5.com/manage/s/article/K000132539

BIG-IP Edge Client for Windows and macOS vulnerability CVE-2023-24461
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-24461

Products affected by CVE-2023-24461

Exploit prediction scoring system (EPSS) score for CVE-2023-24461

CVSS scores for CVE-2023-24461

CWE ids for CVE-2023-24461

References for CVE-2023-24461