CVE-2022-26890
Last modified
CVE-2022-26890 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. EPSS estimates a 0.85% chance of exploitation in the next 30 days.
Description
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | 13.1.0 |
| F5 | Big-Ip Access Policy Manager | 13.1.1 |
| F5 | Big-Ip Access Policy Manager | 13.1.3 |
| F5 | Big-Ip Access Policy Manager | 13.1.4 |
| F5 | Big-Ip Access Policy Manager | 13.1.5 |
| F5 | Big-Ip Access Policy Manager | 14.1.0 |
| F5 | Big-Ip Access Policy Manager | 14.1.2 |
| F5 | Big-Ip Access Policy Manager | 14.1.3 |
| F5 | Big-Ip Access Policy Manager | 14.1.4 |
| F5 | Big-Ip Access Policy Manager | 15.1.0 |
| F5 | Big-Ip Access Policy Manager | 15.1.1 |
| F5 | Big-Ip Access Policy Manager | 15.1.2 |
| F5 | Big-Ip Access Policy Manager | 15.1.3 |
| F5 | Big-Ip Access Policy Manager | 15.1.4 |
| F5 | Big-Ip Access Policy Manager | 15.1.5 |
| F5 | Big-Ip Access Policy Manager | 16.1.0 |
| F5 | Big-Ip Access Policy Manager | 16.1.1 |
| F5 | Big-Ip Access Policy Manager | 16.1.2 |
| F5 | Big-Ip Advanced Web Application Firewall | 13.1.0 |
| F5 | Big-Ip Advanced Web Application Firewall | 13.1.1 |
| F5 | Big-Ip Advanced Web Application Firewall | 13.1.3 |
| F5 | Big-Ip Advanced Web Application Firewall | 13.1.4 |
| F5 | Big-Ip Advanced Web Application Firewall | 13.1.5 |
| F5 | Big-Ip Advanced Web Application Firewall | 14.1.0 |
| F5 | Big-Ip Advanced Web Application Firewall | 14.1.2 |
| F5 | Big-Ip Advanced Web Application Firewall | 14.1.3 |
| F5 | Big-Ip Advanced Web Application Firewall | 14.1.4 |
| F5 | Big-Ip Advanced Web Application Firewall | 15.1.0 |
| F5 | Big-Ip Advanced Web Application Firewall | 15.1.1 |
| F5 | Big-Ip Advanced Web Application Firewall | 15.1.2 |
| F5 | Big-Ip Advanced Web Application Firewall | 15.1.3 |
| F5 | Big-Ip Advanced Web Application Firewall | 15.1.4 |
| F5 | Big-Ip Advanced Web Application Firewall | 15.1.5 |
| F5 | Big-Ip Advanced Web Application Firewall | 16.1.0 |
| F5 | Big-Ip Advanced Web Application Firewall | 16.1.1 |
| F5 | Big-Ip Advanced Web Application Firewall | 16.1.2 |
| F5 | Big-Ip Application Security Manager | 13.1.0 |
| F5 | Big-Ip Application Security Manager | 13.1.1 |
| F5 | Big-Ip Application Security Manager | 13.1.3 |
| F5 | Big-Ip Application Security Manager | 13.1.4 |
| F5 | Big-Ip Application Security Manager | 13.1.5 |
| F5 | Big-Ip Application Security Manager | 14.1.0 |
| F5 | Big-Ip Application Security Manager | 14.1.2 |
| F5 | Big-Ip Application Security Manager | 14.1.3 |
| F5 | Big-Ip Application Security Manager | 14.1.4 |
| F5 | Big-Ip Application Security Manager | 15.1.0 |
| F5 | Big-Ip Application Security Manager | 15.1.1 |
| F5 | Big-Ip Application Security Manager | 15.1.2 |
| F5 | Big-Ip Application Security Manager | 15.1.3 |
| F5 | Big-Ip Application Security Manager | 15.1.4 |
Showing 50 of 54 affected configurations. See NVD for the full list.
References
- https://support.f5.com/csp/article/K03442392Vendor Advisory
- https://support.f5.com/csp/article/K03442392Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-26890?
How severe is CVE-2022-26890?
How do I fix CVE-2022-26890?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-26884Users can read any files by log server, Apache DolphinSchedu…6.5
- CVE-2022-26885When using tasks to read config files, there is a risk of da…7.5
- CVE-2022-26887Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
- CVE-2022-26888Cross-site scripting in the Intel(R) Quartus Prime Pro and S…4.1
- CVE-2022-26889In Splunk Enterprise versions before 8.1.2, the uri path to …8.8
- CVE-2022-2689A vulnerability classified as problematic has been found in …5.4
- CVE-2022-26891Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
- CVE-2022-26894Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
- CVE-2022-26895Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
- CVE-2022-26896Azure Site Recovery Information Disclosure Vulnerability4.9
- CVE-2022-26897Azure Site Recovery Information Disclosure Vulnerability4.9
- CVE-2022-26898Azure Site Recovery Remote Code Execution Vulnerability7.2
Are you affected by CVE-2022-26890?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST