High severity · published May 5, 2022
CVE-2022-29263
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
BIG-IP APM · F5
12.1.x; 11.6.x; 16.1.x before 16.1.2.2; 15.1.x before 15.1.5.1; 14.1.x before 14.1.4.6; 13.1.x before 13.1.5 · source: vendor
BA
BIG-IP APM Clients · F5
7.x before 7.2.1.5 · source: vendor
AP
Access Policy Manager Clients · F5
7.1.8; 7.1.8.5; 7.1.9; 7.1.9.7; 7.1.9.8; 7.2.1; +1 more · source: NVD
BA
Big-ip Access Policy Manager · F5
11.6.1; 11.6.2; 11.6.3; 11.6.4; 11.6.5; 12.1.0; +25 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29263
Vendor Advisory
https://support.f5.com/csp/article/K33552735
More from BIG-IP APM
9.8
CVE-2026-94127
BIG-IP APM OAuth vulnerability
7.7
CVE-2022-31473
BIG-IP APM Appliance mode vulnerability CVE-2022-31473
7.5
CVE-2022-35245
BIG-IP APM access policy vulnerability CVE-2022-35245
7.5
CVE-2022-33203
BIG-IP APM and F5 SSL Orchestrator vulnerability CVE-2022-33203
7.4
CVE-2017-6168
On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a…