CVE-2023-29240: BIG-IQ iControl REST Vulnerability
An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Other sources
An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ system can upload arbitrary files using an undisclosed iControl REST endpoint.
— F5
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-29240.
What is the severity of CVE-2023-29240?
The severity of CVE-2023-29240 is medium with a severity value of 5.4.
Who is affected by CVE-2023-29240?
Users of F5 BIG-IQ Centralized Management versions 8.0.0 to 8.3.0 are affected by CVE-2023-29240.
What can an authenticated attacker do if granted a Viewer or Auditor role on a BIG-IQ?
An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.
Is there a fix available for CVE-2023-29240?
Please refer to the F5 support article at https://my.f5.com/manage/s/article/K000132719 for information on available fixes.