CVE-2022-41622 iControl SOAP vulnerability

2022-12-0703:08:06

CWE-352

www.cve.org

icontrol soap

csrf

vulnerability

all versions

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.473

Percentile

97.5%

JSON

In all versions,

BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "iControl SOAP"
    ],
    "product": "BIG-IP",
    "vendor": "F5",
    "versions": [
      {
        "status": "affected",
        "version": "17.x"
      },
      {
        "status": "affected",
        "version": "16.1.x"
      },
      {
        "status": "affected",
        "version": "15.1.x"
      },
      {
        "status": "affected",
        "version": "14.1.x"
      },
      {
        "status": "affected",
        "version": "13.1.x"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "modules": [
      "iControl SOAP"
    ],
    "product": "BIG-IQ Centralized Management",
    "vendor": "F5",
    "versions": [
      {
        "status": "affected",
        "version": "8.x"
      },
      {
        "status": "affected",
        "version": "7.1.x"
      }
    ]
  }
]