CVE-2022-34865CWE-295

Traffic intelligence feeds vulnerability CVE-2022-34865

Medium · published August 4, 2022

CVSS v3.1
4.8
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2022-08-04T17:48Z
EPSS history
Timeline
  • 04 AUG 17:48Z
    Traffic intelligence feeds vulnerability CVE-2022-34865
    cvelistv5