CVE-2023-29240

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-29240

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

A

n authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References
Link Resource
https://my.f5.com/manage/s/article/K000132719 Vendor Advisory
https://my.f5.com/manage/s/article/K000132719 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:f5:big-iq_centralized_management:*:*:*:*:*:*:*:*
History

27 Jan 2026, 13:50

Type Values Removed Values Added
CWE CWE-434

18 Sep 2025, 20:15

Type Values Removed Values Added
Summary (en) An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (en) An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CWE CWE-269 CWE-863

21 Nov 2024, 07:56

Type Values Removed Values Added
References () https://my.f5.com/manage/s/article/K000132719 - Vendor Advisory () https://my.f5.com/manage/s/article/K000132719 - Vendor Advisory
Information

Published : 2023-05-03 15:15

Updated : 2026-01-27 13:50

NVD link : CVE-2023-29240

Mitre link : CVE-2023-29240

CVE.ORG link : CVE-2023-29240

JSON object : View

Products Affected

f5

CWE
CWE-863

Incorrect Authorization