CVE-2023-28406
BIG-IP Configuration utility vulnerability
At a glance Severity MEDIUM 4.3 EPSS EPSS 1.19 % · percentile 68 (2026-10-27) State PUBLISHED Published 2023-05-03 Updated 2025-01-29 Assigner f5 NVD status Modified Description A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N f5 CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N NVD · f5sirt@f5.com (Secondary) CVSS 3.1 MEDIUM 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.5cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 14.1.0 < 14.1.5.4cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.8.2cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 16.1.0 < 16.1.3.4cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.1.0.1+55 more Affected products Product Versions F5 · BIG-IP unaffected 17.1.0 < * ; affected 17.0.0 < * ; affected 16.1.0 < 16.1.3.4 ; affected 15.1.0 < 15.1.8.2 ; affected 14.1.0 < 14.1.5.4 ; affected 13.1.0 < *
References
Sources
