Cyber Resilience

CVE-2022-41983

Low

Published: 19 October 2022

Published
19 October 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0013 32.0th percentile
Risk Priority 7 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-41983 is a low-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 3.7 (Low).

Operationally, ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

On specific hardware platforms, on BIG-IP versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.7, 14.1.x before 14.1.5.1, and all versions of 13.1.x, while Intel QAT (QuickAssist Technology) and the AES-GCM/CCM cipher is in use, undisclosed conditions can cause BIG-IP to send…

more

data unencrypted even with an SSL Profile applied.

CWE(s)
CWE-319

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

f5
big-ip access policy manager
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip advanced firewall manager
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip advanced web application firewall
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip analytics
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip application acceleration manager
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip application security manager
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip application visibility and reporting
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip carrier-grade nat
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip ddos hybrid defender
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
f5
big-ip domain name system
13.1.0 — 13.1.5 · 14.1.0 — 14.1.5.1 · 15.1.0 — 15.1.7
+9 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-3 Role-based Training
addresses: CWE-319

Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.

CA-3 Information Exchange
addresses: CWE-319

By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.

CM-13 Data Action Mapping
addresses: CWE-319

Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.

CM-6 Configuration Settings
addresses: CWE-319

Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.

MP-1 Policy and Procedures
addresses: CWE-319

Policy addresses secure transport and handling of media to avoid cleartext transmission of sensitive information.

PM-17 Protecting Controlled Unclassified Information on External Systems
addresses: CWE-319

Enforces safeguards against cleartext transmission of CUI when data leaves organizational boundaries to external systems.

SA-9 External System Services
addresses: CWE-319

Explicit controls and continuous oversight on external system services prevent cleartext transmission of sensitive information over provider-managed channels.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-319

Key-establishment procedures specify secure distribution channels that preclude cleartext transmission of key material.

References