CVE-2022-29263: access policy manager clients 7.1.8, 7.1.8.5, 7.1.9 (+4 more affected versions); +3 more affected products

Affected technology

access policy manager clients · 7.1.8
f5

access policy manager clients · 7.1.8.5
f5

access policy manager clients · 7.1.9
f5

access policy manager clients · 7.1.9.7
f5

access policy manager clients · 7.1.9.8
f5

access policy manager clients · 7.2.1
f5

access policy manager clients · 7.2.1.1
f5

big-ip access policy manager · 11.6.1
f5

big-ip access policy manager · 11.6.2
f5

big-ip access policy manager · 11.6.3
f5

big-ip access policy manager · 11.6.4
f5

big-ip access policy manager · 11.6.5
f5

big-ip access policy manager · 12.1.0
f5

big-ip access policy manager · 12.1.1
f5

big-ip access policy manager · 12.1.2
f5

big-ip access policy manager · 12.1.3
f5

big-ip access policy manager · 12.1.4
f5

big-ip access policy manager · 12.1.5
f5

big-ip access policy manager · 12.1.6
f5

big-ip access policy manager · 13.1.0
f5

big-ip access policy manager · 13.1.1
f5

big-ip access policy manager · 13.1.3
f5

big-ip access policy manager · 13.1.4
f5

big-ip access policy manager · 13.1.5
f5

big-ip access policy manager · 14.1.0
f5

big-ip access policy manager · 14.1.2
f5

big-ip access policy manager · 14.1.3
f5

big-ip access policy manager · 14.1.4
f5

big-ip access policy manager · 15.1.0
f5

big-ip access policy manager · 15.1.1
f5

big-ip access policy manager · 15.1.2
f5

big-ip access policy manager · 15.1.3
f5

big-ip access policy manager · 15.1.4
f5

big-ip access policy manager · 15.1.5
f5

big-ip access policy manager · 16.1.0
f5

big-ip access policy manager · 16.1.1
f5

big-ip access policy manager · 16.1.2
f5

big-ip access policy manager · 17.0.0
f5

BIG-IP APM · 12.1.x, 11.6.x, 16.1.x to before 16.1.2.2, 15.1.x to before 15.1.5.1, 14.1.x to before 14.1.4.6, 13.1.x to before 13.1.5
F5

BIG-IP APM Clients · 7.x to before 7.2.1.5
F5

Description’s affected range: versions prior to 16.1.2.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.