CVE-2023-41964

BIG-IP and BIG-IQ Database Variable vulnerability

Medium4.3EPSS 0.30%

Published: 10 Oct 2023
Updated: 18 Sept 2024
Reserved: 5 Oct 2023
Assigned by: f5

Description

The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS scores of CVE-2023-41964, by who scored it
Scored by	CVSS	Score	Vector
f5CNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.30% · top 77% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

CWE-312 Cleartext Storage of Sensitive Information (opens in a new tab)All about CWE-312 and its CVEs

Affected products

F5 · BIG-IP
- unaffected 17.1.0 – < *
- affected 16.1.0 – < 16.1.4
- affected 15.1.0 – < 15.1.9
- affected 14.1.0 – < *
- affected 13.1.0 – < *
F5 · BIG-IQ
- affected 8.1.0 – < *
- affected 8.2.0 – < 8.2.0.1.0.13.97-ENG
- affected 8.3.0 – < 8.3.0.0.12.118-ENG

References (1)

https://my.f5.com/manage/s/article/K20850144 (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-41964](https://trackcve.app/badge/CVE-2023-41964.svg)](https://trackcve.app/cve/CVE-2023-41964)

Record last updated 18 Sept 2024, 20:34 UTC.