{"id":"CVE-2023-46748","aliases":["EUVD-2023-50917","GHSA-9h42-3pgf-qjc8"],"status":"published","title":"BIG-IP Configuration utility authenticated SQL injection vulnerability","description":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04262,"percentile":0.91148,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2023-10-26T20:05:04Z","modified":"2026-06-17T06:31:32Z","kev":{"date_added":"2023-10-31","due_date":"2023-11-21","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-10-31"},{"source":"kev","since":"2023-10-31"}],"products":[{"vendor":"f5","product":"big-ip"},{"vendor":"f5","product":"big-ip configuration utility"},{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_advanced_web_application_firewall"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_application_visibility_and_reporting"},{"vendor":"f5","product":"big-ip_automation_toolchain"},{"vendor":"f5","product":"big-ip_carrier-grade_nat"},{"vendor":"f5","product":"big-ip_container_ingress_services"},{"vendor":"f5","product":"big-ip_ddos_hybrid_defender"},{"vendor":"f5","product":"big-ip_domain_name_system"},{"vendor":"f5","product":"big-ip_fraud_protection_services"},{"vendor":"f5","product":"big-ip_global_traffic_manager"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"big-ip_ssl_orchestrator"},{"vendor":"f5","product":"big-ip_webaccelerator"},{"vendor":"f5","product":"big-ip_websafe"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000137365","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46748","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46748"},{"url":"https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain"},{"url":"https://github.com/advisories/GHSA-9h42-3pgf-qjc8"}],"sources":{"cve":[{"id":"CVE-2023-46748","title":"BIG-IP Configuration utility authenticated SQL injection vulnerability","description":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T20:05:04.967Z","modified":"2025-10-21T23:05:33.293Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50917","description":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T20:05:04Z","modified":"2025-10-21T23:05:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2023-10-31","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-9h42-3pgf-qjc8","title":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n...","description":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T21:30:22Z","modified":"2025-10-22T00:32:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2023-46748","title":"F5 BIG-IP Configuration Utility SQL Injection Vulnerability","description":"F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.","cwes":["CWE-89"],"kev":{"date_added":"2023-10-31","due_date":"2023-11-21","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-46748","description":"An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which \n\nmay allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated","status":"published","published":"2023-10-26T21:15:08.177Z","modified":"2026-06-17T06:31:32.82Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:08:40.004465Z"}]}}