CVE-2023-46748

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 4,5%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada f5 big-ip access policy manager, f5 big-ip advanced firewall manager +10 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 31 Oktober 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Rincian

Terbit di NVD

26 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

4,5% peluang dieksploitasi; lebih tinggi dari 91,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

Masuk KEV

31 Oktober 2023

Tenggat CISA

21 November 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 100 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://my.f5.com/manage/s/article/K000137365 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748 pemerintah AS
• https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/ exploit · advisory pihak ketiga