CVE-2023-22283 BIG-IP Edge Client for Windows vulnerability
An attacker with administrative privileges can execute arbitrary code via DLL hijacking in the BIG-IP Edge Client for Windows.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-22283?
CVE-2023-22283 is a medium-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 1 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-427
Which versions are affected by CVE-2023-22283?
It affects 2 products.
Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Edge.
How do I fix CVE-2023-22283?
No fix has been published for CVE-2023-22283 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22283 being exploited?
There is no known exploitation of CVE-2023-22283 in the wild and no public exploit code.
Other vulnerabilities in F5 Big-Ip Access Policy Manager
- CVE-2023-46747 F5 BIG-IP Configuration Utility Authentication Bypass
- CVE-2022-1388 F5 BIG-IP Missing Authentication
- CVE-2021-22986 F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution
- CVE-2021-22991 F5 BIG-IP Traffic Management Microkernel Buffer Overflow
- CVE-2020-5902 F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution
Sources
Also known as GHSA-w4h2-j6vw-9v7g.