CVE-2022-1388: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip access policy manager11.6.1 and later · up to 11.6.5 inclusive
• f5 big-ip access policy manager12.1.0 and later · up to 12.1.6 inclusive
• f5 big-ip access policy manager13.1.0 and later · before 13.1.5
• f5 big-ip access policy manager14.1.0 and later · before 14.1.4.6
• f5 big-ip access policy manager15.1.0 and later · before 15.1.5.1
• f5 big-ip access policy manager16.1.0 and later · before 16.1.2.2
• f5 big-ip advanced firewall manager11.6.1 and later · up to 11.6.5 inclusive
• f5 big-ip advanced firewall manager12.1.0 and later · up to 12.1.6 inclusive
• f5 big-ip advanced firewall manager13.1.0 and later · before 13.1.5
• f5 big-ip advanced firewall manager14.1.0 and later · before 14.1.4.6
• f5 big-ip advanced firewall manager15.1.0 and later · before 15.1.5.1
• f5 big-ip advanced firewall manager16.1.0 and later · before 16.1.2.2
• f5 big-ip analytics11.6.1 and later · up to 11.6.5 inclusive
• f5 big-ip analytics12.1.0 and later · up to 12.1.6 inclusive
• f5 big-ip analytics13.1.0 and later · before 13.1.5
• f5 big-ip analytics14.1.0 and later · before 14.1.4.6
• f5 big-ip analytics15.1.0 and later · before 15.1.5.1
• f5 big-ip analytics16.1.0 and later · before 16.1.2.2
• f5 big-ip application acceleration manager11.6.1 and later · up to 11.6.5 inclusive
• f5 big-ip application acceleration manager12.1.0 and later · up to 12.1.6 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (f5). Independent of NVD's CPE analysis and usually ahead of it.

• F5 BIG-IP

  • 17.0.0 and later · before 17.0.x*not affected
  • 16.1.x and later · before 16.1.2.2affected
  • 15.1.x and later · before 15.1.5.1affected
  • 14.1.x and later · before 14.1.4.6affected
  • 13.1.x and later · before 13.1.5affected
  • 12.1.x and later · up to and including 12.1.6affected
  • 11.6.x and later · up to and including 11.6.5affected

Other highest-scoring records for the same primary product.

• CVE-2021-22986On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 KEV
  99Now
• CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User InteKEV
  99Now
• CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityKEV
  98Now

Published before and after this one in the same product

• ← EarlierCVE-2022-23030Jan 25, 2022 · On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition
  21Monitor
• ← EarlierCVE-2022-23032Jan 25, 2022 · In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP
  21Monitor
• Later →CVE-2022-1389May 5, 2022 · On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP (fixed in 17.0.0), a cross-site request forgery (CSRF) vu
  17Monitor

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.