CVE-2023-22341: BIG-IP APM OAuth vulnerability
On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate:
An OAuth Server that references an OAuth Provider An OAuth profile with the Authorization Endpoint set to '/' An access profile that references the above OAuth profile and is associated with an HTTPS virtual server
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-22341?
CVE-2023-22341 is a vulnerability in F5 Big-IP Access Policy Manager version 14.1.x before 14.1.5.3 and all versions of 13.1.x that can be exploited through undisclosed requests to cause the Traffic Management Microkernel (TMM) to terminate.
How does CVE-2023-22341 affect F5 Big-IP Access Policy Manager?
CVE-2023-22341 affects F5 Big-IP Access Policy Manager versions 14.1.x before 14.1.5.3 and all versions of 13.1.x when the system is configured with an OAuth Server that references an OAuth Provider and an OAuth profile with undisclosed requests.
What is the severity level of CVE-2023-22341?
The severity level of CVE-2023-22341 is high with a CVSS score of 7.5.
How can I fix CVE-2023-22341?
To fix CVE-2023-22341, update to F5 Big-IP Access Policy Manager version 14.1.5.3 or later, or apply the necessary patches for versions 13.1.x as provided by F5.
Where can I find more information about CVE-2023-22341?
More information about CVE-2023-22341 can be found at the following link: [https://my.f5.com/manage/s/article/K20717585](https://my.f5.com/manage/s/article/K20717585)