CVE-2023-40537: Multi-blade VIPRION Configuration utility session cookie vulnerability

Q: What is the severity of CVE-2023-40537?

CVE-2023-40537 has not been assigned a specific CVSS severity score but is a session management vulnerability affecting authenticated user cookies.

Q: How do I fix CVE-2023-40537?

To fix CVE-2023-40537, it is recommended to upgrade to the latest supported version of F5 BIG-IP software as per vendor guidelines.

Q: Which versions of F5 BIG-IP are affected by CVE-2023-40537?

CVE-2023-40537 affects F5 BIG-IP versions 17.1.0, 16.1.x (up to 16.1.4), 15.1.x (up to 15.1.9), and certain 14.x versions.

Q: Can CVE-2023-40537 lead to session hijacking?

Yes, CVE-2023-40537 can potentially allow an attacker to hijack an authenticated user's session if the user's session cookie remains valid post-logout.

Q: Is there a workaround for CVE-2023-40537?

There are no specific workarounds for CVE-2023-40537 other than upgrading to a patched version of the software.

Published Oct 10, 2023

Updated

An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform.

Affected Software

59 affected componentsFixes available

F5 BIG-IP

17.1.0

F5 BIG-IP>=16.1.0<=16.1.3

16.1.4

F5 BIG-IP>=15.1.0<=15.1.8

15.1.9

F5 BIG-IP>=14.1.0<=14.1.5

F5 BIG-IP>=13.1.0<=13.1.5

F5 BIG-IP Access Policy Manager>=13.1.0<=14.1.5

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.9

F5 BIG-IP Access Policy Manager>=16.1.0<16.1.4

F5 BIG-IP Advanced Firewall Manager>=13.1.0<=14.1.5

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.9

F5 BIG-IP Advanced Firewall Manager>=16.1.0<16.1.4

F5 BIG-IP Application Security Manager>=13.1.0<=14.1.5

F5 BIG-IP Application Security Manager>=15.1.0<15.1.9

F5 BIG-IP Application Security Manager>=16.1.0<16.1.4

F5 Big-ip Domain Name System>=13.1.0<=14.1.5

F5 Big-ip Domain Name System>=15.1.0<15.1.9

F5 Big-ip Domain Name System>=16.1.0<16.1.4

F5 Big-ip Local Traffic Manager>=13.1.0<=14.1.5

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.9

F5 Big-ip Local Traffic Manager>=16.1.0<16.1.4

F5 Big-ip Advanced Web Application Firewall>=13.1.0<=14.1.5

F5 Big-ip Advanced Web Application Firewall>=15.1.0<15.1.9

F5 Big-ip Advanced Web Application Firewall>=16.1.0<16.1.4

F5 BIG-IP Analytics>=13.1.0<=14.1.5

F5 BIG-IP Analytics>=15.1.0<15.1.9

F5 BIG-IP Analytics>=16.1.0<16.1.4

F5 Big-ip Application Acceleration Manager>=13.1.0<=14.1.5

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.9

F5 Big-ip Application Acceleration Manager>=16.1.0<16.1.4

F5 Big-ip Application Visibility And Reporting>=13.1.0<=14.1.5

F5 Big-ip Application Visibility And Reporting>=15.1.0<15.1.9

F5 Big-ip Application Visibility And Reporting>=16.1.0<16.1.4

F5 Big-ip Carrier-grade Nat>=13.1.0<=14.1.5

F5 Big-ip Carrier-grade Nat>=15.1.0<15.1.9

F5 Big-ip Carrier-grade Nat>=16.1.0<16.1.4

F5 Big-ip Ddos Hybrid Defender>=13.1.0<=14.1.5

F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.9

F5 Big-ip Ddos Hybrid Defender>=16.1.0<16.1.4

F5 Big-ip Fraud Protection Service>=13.1.0<=14.1.5

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.9

F5 Big-ip Fraud Protection Service>=16.1.0<16.1.4

F5 Big-ip Global Traffic Manager>=13.1.0<=14.1.5

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.9

F5 Big-ip Global Traffic Manager>=16.1.0<16.1.4

F5 Big-ip Link Controller>=13.1.0<=14.1.5

F5 Big-ip Link Controller>=15.1.0<15.1.9

F5 Big-ip Link Controller>=16.1.0<16.1.4

F5 Big-ip Policy Enforcement Manager>=13.1.0<=14.1.5

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.9

F5 Big-ip Policy Enforcement Manager>=16.1.0<16.1.4

F5 BIG-IP SSL Orchestrator>=13.1.0<=14.1.5

F5 BIG-IP SSL Orchestrator>=15.1.0<15.1.9

F5 BIG-IP SSL Orchestrator>=16.1.0<16.1.4

F5 Big-ip Webaccelerator>=13.1.0<=14.1.5

F5 Big-ip Webaccelerator>=15.1.0<15.1.9

F5 Big-ip Webaccelerator>=16.1.0<16.1.4

F5 Big-ip Websafe>=13.1.0<=14.1.5

F5 Big-ip Websafe>=15.1.0<15.1.9

F5 Big-ip Websafe>=16.1.0<16.1.4

Event History

Oct 10, 2023

Advisory Published

via F5·10:28 AM

CVE Published

via MITRE·12:32 PM

Data Sourced

via MITRE·12:32 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-40537?

CVE-2023-40537 has not been assigned a specific CVSS severity score but is a session management vulnerability affecting authenticated user cookies.

How do I fix CVE-2023-40537?

To fix CVE-2023-40537, it is recommended to upgrade to the latest supported version of F5 BIG-IP software as per vendor guidelines.

Which versions of F5 BIG-IP are affected by CVE-2023-40537?

CVE-2023-40537 affects F5 BIG-IP versions 17.1.0, 16.1.x (up to 16.1.4), 15.1.x (up to 15.1.9), and certain 14.x versions.

Can CVE-2023-40537 lead to session hijacking?

Yes, CVE-2023-40537 can potentially allow an attacker to hijack an authenticated user's session if the user's session cookie remains valid post-logout.

Is there a workaround for CVE-2023-40537?