Login Request a demo
High severity · published May 5, 2022
CVE-2022-28716
On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x 11.6.x, a…
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
On 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x 11.6.x, a DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP AFM, CGNAT, and PEM Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Big-ip Advanced Firewall Manager · F5
11.6.1 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 before 13.1.5; 14.1.0 before 14.1.4.6; 15.1.0 before 15.1.5.1; 16.1.0 before 16.1.2.2 · source: NVD
BC
Big-ip Carrier-grade Nat · F5
11.6.1 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 before 13.1.5; 14.1.0 before 14.1.4.6; 15.1.0 before 15.1.5.1; 16.1.0 before 16.1.2.2 · source: NVD
BP
Big-ip Policy Enforcement Manager · F5
11.6.1 through 11.6.5; 12.1.0 through 12.1.6; 13.1.0 before 13.1.5; 14.1.0 before 14.1.4.6; 15.1.0 before 15.1.5.1; 16.1.0 before 16.1.2.2 · source: NVD
Affected product
BA
Big-ip Advanced Firewall Manager
F5
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-28716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-28716
Mitigation
https://support.f5.com/csp/article/K25451853
More from Big-ip Advanced Firewall Manager
9.8
CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
9.8
CVE-2022-1388
F5 BIG-IP Missing Authentication Vulnerability
9.8
CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
9.8
CVE-2021-22986
F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability
9.8
CVE-2020-5902
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability