Forum Discussion
THE_BLUE
Cirrostratus
CirrostratusBIG-IP Configuration utility vulnerability CVE-2023-38138
Can anyone clarify more about this vulnerability? is that mean if we have xxx.com and secure by WAF , one use have admin privilage to xxx.com can expolit this vulnerability? or they mean admin priv...
Hello THE_BLUE
all CVE's that F5 documents in its Security Advisory series specifically refer to vulnerabilities that affect/compromise F5 products only, in this case BIG-IP.
Any application that runs on-top of the BIG-IP, like an HTTP portal, will not be covered.So, unless xxx.com resolves to an IP address on the BIG-IP that allows Configuration Utility access (webI or SSH), it shoudn't be considered as an attack vector.
CA_Valli
MVP
MVPHello THE_BLUE
all CVE's that F5 documents in its Security Advisory series specifically refer to vulnerabilities that affect/compromise F5 products only, in this case BIG-IP.
Any application that runs on-top of the BIG-IP, like an HTTP portal, will not be covered.
So, unless xxx.com resolves to an IP address on the BIG-IP that allows Configuration Utility access (webI or SSH), it shoudn't be considered as an attack vector.
THE_BLUECirrostratus
CirrostratusThank you
So, unless xxx.com resolves to an IP address on the BIG-IP that allows Configuration Utility access (webI or SSH), it shoudn't be considered as an attack vector.
this mean if xxx.com secure by waf and it's mapped to xxx server . this will not have affect to WAF because there is no relation between xxx.com and WAF ssh .
so this vulnerability will be compromised by users who have access to WAF , right?
- CA_Valli
THE_BLUE wrote:
this will not have affect to WAF because there is no relation between xxx.com and WAF ssh .
Correct
THE_BLUE wrote:so this vulnerability will be compromised by users who have access to WAF , right?
Correct again - user needs to be logged to the WAF, and send a packet that contains the specific URL (undisclosed so far) that opens the attack vector.