CVE-2024-23603: BIG-IP Advanced WAF and ASM Configuration utility vulnerability
A SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
Other sources
An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.1.10
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23603?
CVE-2024-23603 has been categorized with a medium severity due to the potential for SQL injection.
How do I fix CVE-2024-23603?
To fix CVE-2024-23603, upgrade to the appropriate patched version of the F5 BIG-IP software: 17.1.1, 16.1.4, or 15.1.10.
Which versions of F5 BIG-IP are affected by CVE-2024-23603?
CVE-2024-23603 affects F5 BIG-IP Application Security Manager and Advanced Web Application Firewall versions between 15.1.0 to 15.1.9, 16.1.0 to 16.1.4, and 17.1.0.
Is CVE-2024-23603 remotely exploitable?
Yes, CVE-2024-23603 is remotely exploitable, allowing attackers to potentially inject SQL queries through vulnerable components.
What types of attacks can CVE-2024-23603 allow?
CVE-2024-23603 can allow attackers to manipulate database queries, leading to unauthorized data access or modification.