F5 BIG-IP Fraud Protection Services vulnerabilities

2 CVEs affecting F5 BIG-IP Fraud Protection Services, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-46748, published 2023-10-26.

More from F5.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-46747: F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability, published 2023-10-26. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-10-31. EPSS: 96.5% chance of exploitation in the next 30 days. Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute…
• CVE-2023-46748: F5 BIG-IP Configuration Utility SQL Injection Vulnerability, published 2023-10-26. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-10-31. EPSS: 4.5% chance of exploitation in the next 30 days. An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP…