CVE-2023-22341: BIG-IP APM OAuth vulnerability
First published: Wed Feb 01 2023(Updated: )
On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate: * An OAuth Server that references an OAuth Provider * An OAuth profile with the Authorization Endpoint set to '/' * An access profile that references the above OAuth profile and is associated with an HTTPS virtual server Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Big-ip Access Policy Manager | >=13.1.0<=13.1.5 | |
| F5 Big-ip Access Policy Manager | >=14.1.0<14.1.5.3 | |
| F5 BIG-IP APM | ||
| F5 BIG-IP APM | >=14.1.0<=14.1.5 | 14.1.5.3 |
| F5 BIG-IP APM | >=13.1.0<=13.1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-22341?
CVE-2023-22341 is a vulnerability in F5 Big-IP Access Policy Manager version 14.1.x before 14.1.5.3 and all versions of 13.1.x that can be exploited through undisclosed requests to cause the Traffic Management Microkernel (TMM) to terminate.
How does CVE-2023-22341 affect F5 Big-IP Access Policy Manager?
CVE-2023-22341 affects F5 Big-IP Access Policy Manager versions 14.1.x before 14.1.5.3 and all versions of 13.1.x when the system is configured with an OAuth Server that references an OAuth Provider and an OAuth profile with undisclosed requests.
What is the severity level of CVE-2023-22341?
The severity level of CVE-2023-22341 is high with a CVSS score of 7.5.
How can I fix CVE-2023-22341?
To fix CVE-2023-22341, update to F5 Big-IP Access Policy Manager version 14.1.5.3 or later, or apply the necessary patches for versions 13.1.x as provided by F5.
Where can I find more information about CVE-2023-22341?
More information about CVE-2023-22341 can be found at the following link: [https://my.f5.com/manage/s/article/K20717585](https://my.f5.com/manage/s/article/K20717585)
- collector/nvd-index
- agent/type
- collector/f5-advisory
- source/F5
- alias/CVE-2023-22341
- agent/software-canonical-lookup
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/description
- agent/tags
- agent/event
- vendor/f5
- canonical/f5 big-ip access policy manager
- version/f5 big-ip access policy manager/13.1.0
- version/f5 big-ip access policy manager/13.1.5
- version/f5 big-ip access policy manager/14.1.0
- canonical/f5 big-ip apm
- version/f5 big-ip apm/14.1.0
- version/f5 big-ip apm/14.1.5
- version/f5 big-ip apm/13.1.0
- version/f5 big-ip apm/13.1.5