CVEvulnerability

CVE-2023-46748

8.8 HIGH Known exploited Published 2023-10-26 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

F5 BIG-IP Configuration Utility SQL Injection Vulnerability — F5 BIG-IP Configuration Utility

F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.

Added to KEV
2023-10-31
Remediation due
2023-11-21
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
https://my.f5.com/manage/s/article/K000137365 ; https://nvd.nist.gov/vuln/detail/CVE-2023-46748
Status
Analyzed
Published
2023-10-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89

Description

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected configurations

• f5 big-ip access policy manager (>= 13.1.0 <= 13.1.5) • f5 big-ip access policy manager (>= 14.1.0 <= 14.1.5) • f5 big-ip access policy manager (>= 15.1.0 <= 15.1.10) • f5 big-ip access policy manager (>= 16.1.0 <= 16.1.4) • f5 big-ip access policy manager (>= 17.1.0 <= 17.1.1) • f5 big-ip advanced firewall manager (>= 13.1.0 <= 13.1.5) • f5 big-ip advanced firewall manager (>= 14.1.0 <= 14.1.5) • f5 big-ip advanced firewall manager (>= 15.1.0 <= 15.1.10) • f5 big-ip advanced firewall manager (>= 16.1.0 <= 16.1.4) • f5 big-ip advanced firewall manager (>= 17.1.0 <= 17.1.1) • f5 big-ip carrier-grade nat (>= 13.1.0 <= 13.1.5) • f5 big-ip carrier-grade nat (>= 14.1.0 <= 14.1.5) • f5 big-ip carrier-grade nat (>= 15.1.0 <= 15.1.10) • f5 big-ip carrier-grade nat (>= 16.1.0 <= 16.1.4) • f5 big-ip carrier-grade nat (>= 17.1.0 <= 17.1.1) • f5 big-ip ddos hybrid defender (>= 13.1.0 <= 13.1.5) • f5 big-ip ddos hybrid defender (>= 14.1.0 <= 14.1.5) • f5 big-ip ddos hybrid defender (>= 15.1.0 <= 15.1.10) • f5 big-ip ddos hybrid defender (>= 16.1.0 <= 16.1.4) • f5 big-ip ddos hybrid defender (>= 17.1.0 <= 17.1.1) • f5 big-ip ssl orchestrator (>= 13.1.0 <= 13.1.5) • f5 big-ip ssl orchestrator (>= 14.1.0 <= 14.1.5) • f5 big-ip ssl orchestrator (>= 15.1.0 <= 15.1.10) • f5 big-ip ssl orchestrator (>= 16.1.0 <= 16.1.4) • f5 big-ip ssl orchestrator (>= 17.1.0 <= 17.1.1) • f5 big-ip local traffic manager (>= 13.1.0 <= 13.1.5) • f5 big-ip local traffic manager (>= 14.1.0 <= 14.1.5) • f5 big-ip local traffic manager (>= 15.1.0 <= 15.1.10) • f5 big-ip local traffic manager (>= 16.1.0 <= 16.1.4) • f5 big-ip local traffic manager (>= 17.1.0 <= 17.1.1) • f5 big-ip policy enforcement manager (>= 13.1.0 <= 13.1.5) • f5 big-ip policy enforcement manager (>= 14.1.0 <= 14.1.5) • f5 big-ip policy enforcement manager (>= 15.1.0 <= 15.1.10) • f5 big-ip policy enforcement manager (>= 16.1.0 <= 16.1.4) • f5 big-ip policy enforcement manager (>= 17.1.0 <= 17.1.1) • f5 big-ip automation toolchain (>= 13.1.0 <= 13.1.5) • f5 big-ip automation toolchain (>= 14.1.0 <= 14.1.5) • f5 big-ip automation toolchain (>= 15.1.0 <= 15.1.10) • f5 big-ip automation toolchain (>= 16.1.0 <= 16.1.4) • f5 big-ip automation toolchain (>= 17.1.0 <= 17.1.1) • f5 big-ip container ingress services (>= 13.1.0 <= 13.1.5) • f5 big-ip container ingress services (>= 14.1.0 <= 14.1.5) • f5 big-ip container ingress services (>= 15.1.0 <= 15.1.10) • f5 big-ip container ingress services (>= 16.1.0 <= 16.1.4) • f5 big-ip container ingress services (>= 17.1.0 <= 17.1.1) • f5 big-ip advanced web application firewall (>= 13.1.0 <= 13.1.5) • f5 big-ip advanced web application firewall (>= 14.1.0 <= 14.1.5) • f5 big-ip advanced web application firewall (>= 15.1.0 <= 15.1.10) • f5 big-ip advanced web application firewall (>= 16.1.0 <= 16.1.4) • f5 big-ip advanced web application firewall (>= 17.1.0 <= 17.1.1) • f5 big-ip domain name system (>= 13.1.0 <= 13.1.5) • f5 big-ip domain name system (>= 14.1.0 <= 14.1.5) • f5 big-ip domain name system (>= 15.1.0 <= 15.1.10) • f5 big-ip domain name system (>= 16.1.0 <= 16.1.4) • f5 big-ip domain name system (>= 17.1.0 <= 17.1.1) • f5 big-ip application security manager (>= 13.1.0 <= 13.1.5) • f5 big-ip application security manager (>= 14.1.0 <= 14.1.5) • f5 big-ip application security manager (>= 15.1.0 <= 15.1.10) • f5 big-ip application security manager (>= 16.1.0 <= 16.1.4) • f5 big-ip application security manager (>= 17.1.0 <= 17.1.1) … and 40 more

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References