CVE-2022-27181: Medium severity F5 BIG-IP Access Policy Manager vulnerability
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when APM is configured on a virtual server and the associated access profile is configured with APM AAA NTLM Auth, undisclosed requests can cause an increase in internal resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-27181?
CVE-2022-27181 is classified as a high severity vulnerability due to potential exploitation risks affecting F5 BIG-IP APM.
How do I fix CVE-2022-27181?
To fix CVE-2022-27181, update your F5 BIG-IP APM to a version that is not affected, such as 16.1.2.2 or later for version 16.1.x.
Which versions of F5 BIG-IP APM are affected by CVE-2022-27181?
F5 BIG-IP APM versions prior to 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5, and all versions of 12.1.x and 11.6.x are affected by CVE-2022-27181.
What are the potential impacts of CVE-2022-27181?
CVE-2022-27181 may allow unauthorized access and manipulation of resources, leading to possible data exposure or disruption.
Is there a workaround for CVE-2022-27181 while waiting for a patch?
While waiting for a patch for CVE-2022-27181, it is advised to review access configurations and limit exposure to affected services.