CVE-2023-38418 : The BIG-IP Edge Client Installer on macOS does not follow best practices for ele

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published 2023-08-02 16:15:11

Updated 2023-08-08 17:14:38

Source F5 Networks

View at NVD, CVE.org

Products affected by CVE-2023-38418

F5 » Big-ip Access Policy Manager
Versions from including (>=) 17.0.0 and up to, including, (<=) 17.1.0
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 16.1.0 and up to, including, (<=) 16.1.3
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 14.1.0 and up to, including, (<=) 14.1.5
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 13.1.0 and up to, including, (<=) 13.1.5
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Big-ip Access Policy Manager
Versions from including (>=) 15.1.0 and up to, including, (<=) 15.1.9
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
Matching versions
F5 » Access Policy Manager Clients
Versions from including (>=) 7.2.3 and before (<) 7.2.4.3
cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-38418

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 7 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-38418

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	F5 Networks
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-38418

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Assigned by: f5sirt@f5.com (Primary)

References for CVE-2023-38418

https://my.f5.com/manage/s/article/K000134746

BIG-IP Edge Client for macOS vulnerability CVE-2023-38418
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-38418

Products affected by CVE-2023-38418

Exploit prediction scoring system (EPSS) score for CVE-2023-38418

CVSS scores for CVE-2023-38418

CWE ids for CVE-2023-38418

References for CVE-2023-38418