title: Traffic intelligence feeds vulnerability CVE-2022-34865
description: In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
problem types: CWE-295 Improper Certificate Validation
affected:
{
product: BIG-IP
vendor: F5
versions:
lessThan: 13.1.x*, status: affected, version: 13.1.0, versionType: custom
lessThan: 14.1.5, status: affected, version: 14.1.x, versionType: custom
lessThan: 15.1.6.1, status: affected, version: 15.1.x, versionType: custom
lessThan: 16.1.x*, status: unaffected, version: 16.1.0, versionType: custom
lessThan: 17.0.x*, status: unaffected, version: 17.0.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]