CVE-2022-33947: BIG-IP DNS TMUI Vulnerability CVE-2022-33947
In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, a vulnerability exists in undisclosed pages of the BIG-IP DNS Traffic Management User Interface (TMUI) that allows an authenticated attacker with at least operator role privileges to cause the Tomcat process to restart and perform unauthorized DNS requests and operations through undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-33947?
CVE-2022-33947 has a severity rating that indicates it poses a significant risk to affected systems.
Who is affected by CVE-2022-33947?
CVE-2022-33947 affects specific versions of the F5 BIG-IP Domain Name System software, particularly 13.1.x, 14.1.x, 15.1.x, and 16.1.x prior to their respective fixed versions.
How do I fix CVE-2022-33947?
To remediate CVE-2022-33947, update your F5 BIG-IP software to the latest version released after the vulnerability was disclosed.
What types of attacks are possible via CVE-2022-33947?
CVE-2022-33947 allows authenticated attackers with at least operator roles to exploit vulnerabilities in the BIG-IP DNS Traffic Management User Interface.
Is authentication required to exploit CVE-2022-33947?
Yes, an attacker must be authenticated and possess at least an operator role to exploit CVE-2022-33947.