CVE-2022-23009 Missing authorization in BIG-IQ Centralized Management
An authenticated admin on one managed BIG-IP device can access other devices managed by the same BIG-IQ system due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23009?
CVE-2022-23009 is a high-severity missing authorization vulnerability in F5 Big-Iq Centralized Management, published on 25 Jan 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access other BIG-IP devices managed by the same BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-863
Which versions are affected by CVE-2022-23009?
It affects 1 product.
Products include F5 Big-Iq Centralized Management.
How do I fix CVE-2022-23009?
No fix has been published for CVE-2022-23009 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23009 being exploited?
There is no known exploitation of CVE-2022-23009 in the wild and no public exploit code.
Other vulnerabilities in F5 Big-Iq Centralized Management
Sources
Also known as GHSA-3jr5-px2c-8j7c.