In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5 / 15.1.6.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K25046752 advisory.

  - In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic     Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential     data poisoning. Note: Software versions which have reached End of Technical Support (EoTS) are not     evaluated. (CVE-2022-34865)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2022-34865

critical

Tenable Plugins

critical