CVE-2024-23603

Low

Description

An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

SeverityLow

CVSS3.8

Exploit probability23. percentile0.3%

Product

F5 Big-ip Application Security Manager

PublishedFeb 14, 2024

First seenFeb 14, 2024

Weakness typeCWE-89SQL injection

How to fix

Update

f5 big-ip_application_security_manager15.1.9, 16.1.4 or later
f5 big-ip_advanced_web_application_firewall15.1.10, 16.1.4 or later

Vendor advisories

my.f5.com/manage/s/article/K000138047

Affected products

Product	Affected versions	Fixed in
f5 big-ip_application_security_manager	15.1.0 ≤ v < 15.1.9, 16.1.0 ≤ v < 16.1.4, 17.1.0	15.1.9, 16.1.4
f5 big-ip_advanced_web_application_firewall	15.1.0 ≤ v < 15.1.10, 16.1.0 ≤ v < 16.1.4, 17.1.0	15.1.10, 16.1.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.