CVE-2023-41373: BIG-IP Configuration Utility vulnerability

Modified

Published 10-10-2023Last modified 19-09-2024

Vulnerability summary

CVE-2023-41373 is a critical (CVSS 9.9) Path Traversal vulnerability in f5 big-ip. EPSS estimates a 2.29% chance of exploitation in the next 30 days, higher than 83% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.9/10

010

Critical · v3.1 (NVD)

EPSS score

2.29%

0%100%

Low · -0.09 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

10-10-2023
PublishedVulnerability first disclosed.
19-09-2024
Last modifiedVulnerability information updated.

Description

A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.9

EPSS trend

Probability

2.29%

Chance of exploitation in the next 30 days

Percentile

83%

Versus all other CVEs

30-day change

Decrease -0.09 pp

From 2.38% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

F519 products

big-ip≥ 17.1.0, < 17.1.0.3 | ≥ 16.1.0, < 16.1.4.1 | ≥ 15.1.0, < 15.1.10.2 | ≥ 14.1.0, < 14.1.5.6 | ≥ 13.1.0 (No fix recorded)
big-ip_access_policy_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_advanced_firewall_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_advanced_web_application_firewall≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_analytics≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3

big-ip_application_acceleration_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_application_security_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_application_visibility_and_reporting≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_carrier-grade_nat≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_ddos_hybrid_defender≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_domain_name_system≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_fraud_protection_service≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_global_traffic_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_link_controller≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_local_traffic_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_policy_enforcement_manager≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_ssl_orchestrator≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_webaccelerator≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3
big-ip_websafe≥ 13.1.0, ≤ 13.1.5 | ≥ 14.1.0, < 14.1.5.6 | ≥ 15.1.0, < 15.1.10.2 | ≥ 16.1.0, < 16.1.4.1 | ≥ 17.1.0, < 17.1.0.3

Show all 19

1 vendor · 19 products

References

1 links

my.f5.com/manage/s/article/K000135689Vendor Advisory