Vulnerability · Published May 5, 2022 · Assigned by f5

CVE-2022-1468

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in BIG-IP from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 45.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at least guest role privileges can cause processing delays to iControl REST requests via undisclosed requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products (as reported)

Vendor	Product	Versions
F5	BIG-IP	17.0.x16.1.x15.1.x14.1.x13.1.x12.1.x11.6.x

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://support.f5.com/csp/article/K15101402 x_refsource_MISC