CVE-2023-22418

MEDIUM

BIG-IP APM 13.1.0-13.1.5, 14.1.0-14.1.5.3, 15.1.0-15.1.7, 16.1.0-16.1.3.3, 17.0.0-17.0.0.2 Open Redirect

Title source: llm
STIX 2.1

Description

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References (1)

Core 1
Core References

Scores

CVSS v3 6.1
EPSS 0.0033
EPSS Percentile 55.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (12)
f5/big-ip_access_policy_manager 13.1.0 - 13.1.5
f5/big-ip_advanced_firewall_manager 13.1.0 - 13.1.5
f5/big-ip_analytics 13.1.0 - 13.1.5
f5/big-ip_application_acceleration_manager 13.1.0 - 13.1.5
f5/big-ip_application_security_manager 13.1.0 - 13.1.5
f5/big-ip_ddos_hybrid_defender 13.1.0 - 13.1.5
f5/big-ip_domain_name_system 14.1.0 - 14.1.5.3
f5/big-ip_fraud_protection_service 13.1.0 - 13.1.5
f5/big-ip_link_controller 13.1.0 - 13.1.5
f5/big-ip_local_traffic_manager 13.1.0 - 13.1.5
... and 2 more
Published Feb 01, 2023
Tracked Since Feb 18, 2026