CVE-2022-35735CWE-74

BIG-IP monitor configuration vulnerability CVE-2022-35735

High · published August 4, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configuration utility in an undisclosed manner leading to a privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00912 · 59.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2022-08-04T17:50Z
EPSS history
Timeline
  • 04 AUG 17:50Z
    BIG-IP monitor configuration vulnerability CVE-2022-35735
    cvelistv5