CVE-2023-22418CWE-601

BIG-IP APM virtual server vulnerability

Medium · published February 1, 2023

CVSS v3.1
6.1
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.7, 14.1.x before 14.1.5.3, and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP APM access policy. This vulnerability allows an unauthenticated malicious attacker to build an open redirect URI. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2023-02-01T17:55Z
EPSS history
Timeline
  • 01 FEB 17:55Z
    BIG-IP APM virtual server vulnerability
    cvelistv5