CVE-2022-23031: XEE
First published: Tue Jan 25 2022(Updated: )
On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI), also referred to as the Configuration utility, that allows an authenticated high-privileged attacker to read local files and force BIG-IP to send HTTP requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Big-ip Advanced Web Application Firewall | >=14.1.0<=14.1.4 | |
| F5 Big-ip Advanced Web Application Firewall | >=15.1.0<=15.1.3 | |
| F5 Big-ip Advanced Web Application Firewall | >=16.0.0<=16.1.0 | |
| F5 BIG-IP Application Security Manager | >=14.1.0<=14.1.4 | |
| F5 BIG-IP Application Security Manager | >=15.1.0<=15.1.3 | |
| F5 BIG-IP Application Security Manager | >=16.0.0<=16.1.0 | |
| F5 Big-ip Fraud Protection Service | >=14.1.0<=14.1.4 | |
| F5 Big-ip Fraud Protection Service | >=15.1.0<=15.1.3 | |
| F5 Big-ip Fraud Protection Service | >=16.0.0<=16.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-23031.
Which products are affected by CVE-2022-23031?
The vulnerability affects F5 Big-ip Advanced Web Application Firewall (versions 14.1.x - 14.1.4), F5 Big-ip Application Security Manager (versions 14.1.x - 14.1.4), F5 Big-ip Fraud Protection Service (versions 14.1.x - 14.1.4), F5 Big-ip Advanced Web Application Firewall (versions 15.1.x - 15.1.3), F5 Big-ip Application Security Manager (versions 15.1.x - 15.1.3), F5 Big-ip Fraud Protection Service (versions 15.1.x - 15.1.3), F5 Big-ip Advanced Web Application Firewall (versions 16.0.x - 16.1.0), F5 Big-ip Application Security Manager (versions 16.0.x - 16.1.0), and F5 Big-ip Fraud Protection Service (versions 16.0.x - 16.1.0).
What is the severity level of CVE-2022-23031?
The severity level of CVE-2022-23031 is medium with a severity value of 4.9.
What is the description of CVE-2022-23031?
CVE-2022-23031 is an XML External Entity (XXE) vulnerability that exists in an undisclosed page of the F5 Advanced Web Application Firewall (Advanced WAF) and BIG-IP ASM Traffic Management User Interface (TMUI) on affected versions of BIG-IP FPS, ASM, and Advanced WAF.
How can I fix the vulnerability (CVE-2022-23031)?
To fix CVE-2022-23031, it is recommended to update the affected software to version 14.1.4.4, 15.1.4, or 16.1.1 depending on the respective version used.
- collector/nvd-index
- vendor/f5
- canonical/f5 big-ip advanced web application firewall
- version/f5 big-ip advanced web application firewall/14.1.0
- version/f5 big-ip advanced web application firewall/14.1.4
- version/f5 big-ip advanced web application firewall/15.1.0
- version/f5 big-ip advanced web application firewall/15.1.3
- version/f5 big-ip advanced web application firewall/16.0.0
- version/f5 big-ip advanced web application firewall/16.1.0
- canonical/f5 big-ip application security manager
- version/f5 big-ip application security manager/14.1.0
- version/f5 big-ip application security manager/14.1.4
- version/f5 big-ip application security manager/15.1.0
- version/f5 big-ip application security manager/15.1.3
- version/f5 big-ip application security manager/16.0.0
- version/f5 big-ip application security manager/16.1.0
- canonical/f5 big-ip fraud protection service
- version/f5 big-ip fraud protection service/14.1.0
- version/f5 big-ip fraud protection service/14.1.4
- version/f5 big-ip fraud protection service/15.1.0
- version/f5 big-ip fraud protection service/15.1.3
- version/f5 big-ip fraud protection service/16.0.0
- version/f5 big-ip fraud protection service/16.1.0