CVE-2022-28695

HIGH

F5 BIG-IP AFM <16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 - Privilege Esc...

Title source: llm
STIX 2.1

Description

On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows an attacker to run arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://support.f5.com/csp/article/K08510472

Scores

CVSS v3 7.2
EPSS 0.0044
EPSS Percentile 63.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (19)
f5/big-ip_advanced_firewall_manager 13.1.0
f5/big-ip_advanced_firewall_manager 13.1.1
f5/big-ip_advanced_firewall_manager 13.1.3
f5/big-ip_advanced_firewall_manager 13.1.4
f5/big-ip_advanced_firewall_manager 13.1.5
f5/big-ip_advanced_firewall_manager 14.1.0
f5/big-ip_advanced_firewall_manager 14.1.2
f5/big-ip_advanced_firewall_manager 14.1.3
f5/big-ip_advanced_firewall_manager 14.1.4
f5/big-ip_advanced_firewall_manager 15.1.0
... and 9 more
Published May 05, 2022
Tracked Since Feb 18, 2026