CVE-2024-23308

When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. The condition results from setting the Request Body Handling option in the Header-Based Content Profile for an Allowed URL with "Apply value and content signatures and detect threat campaigns." Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://my.f5.com/manage/s/article/K000137416	Vendor Advisory
https://my.f5.com/manage/s/article/K000137416	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::

History

No history.

Information

Published : 2024-02-14 17:15

Updated : 2024-12-12 19:10

NVD link : CVE-2024-23308

Mitre link : CVE-2024-23308

CVE.ORG link : CVE-2024-23308

JSON object : View

Products Affected

f5

big-ip_application_security_manager
big-ip_advanced_web_application_firewall

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2024-23308", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-02-14T17:15:13.200", "references": [{"url": "https://my.f5.com/manage/s/article/K000137416", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://my.f5.com/manage/s/article/K000137416", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-476"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "\nWhen a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed requests can cause the BD process to terminate. The condition results from setting the Request Body Handling option in the Header-Based Content Profile for an Allowed URL with \"Apply value and content signatures and detect threat campaigns.\"\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"}, {"lang": "es", "value": "Cuando una pol\u00edtica BIG-IP Advanced WAF o BIG-IP ASM con una opci\u00f3n de Manejo del cuerpo de la solicitud se adjunta a un servidor virtual, las solicitudes no divulgadas pueden hacer que el proceso BD finalice. La condici\u00f3n resulta de configurar la opci\u00f3n Manejo del cuerpo de la solicitud en el perfil de contenido basado en encabezado para una URL permitida con \"Aplicar firmas de valor y contenido y detectar campa\u00f1as de amenazas\". Nota: Las versiones de software que han llegado al final del soporte t\u00e9cnico (EoTS) no se eval\u00faan"}], "lastModified": "2024-12-12T19:10:12.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F805B12C-7196-44A8-897C-4075D4B9EF5A", "versionEndExcluding": "17.1.1", "versionStartIncluding": "17.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4453B671-B10F-4B82-A41D-048B12F37EA8", "versionEndExcluding": "17.1.1", "versionStartIncluding": "17.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}