Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-22341

BIG-IP APM OAuth vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
f5

Description

On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel (TMM) to terminate: * An OAuth Server that references an OAuth Provider * An OAuth profile with the Authorization Endpoint set to '/' * An access profile that references the above OAuth profile and is associated with an HTTPS virtual server Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

F5 BIG-IP

Default version status: unknown

  • 14.1.0 to < 14.1.5.3affected
  • 13.1.0 to < *affected

References