Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2023-46748

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 8.8 · HighBuzz score 53.8KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 53.8

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 8.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
8.0
3 sources across 1 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • Security Affairs newsletter Round 444 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Kinsing threat actors probed the Looney Tunables flaws in recent attacks ZDI discloses four zero-day flaws […]

    newssecurityaffairs.comNov 5, 2023, 1:07 PM
  • Week in review: Exploited Citrix Bleed vulnerability, Atlassian patches critical Confluence bugHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: AI threat landscape: Model theft and inference attacks emerge as top concerns In this Help Net Security interview, Guy Guzner, CEO at Savvy, discusses the challenges and opportunities presented by in-house AI models, the security landscape surrounding them, and the future of AI cybersecurity. A closer look at healthcare’s battle with AI-driven attacks In this Help Net Security interview, Troy … More →

    newswww.helpnetsecurity.comNov 5, 2023, 9:00 AM
  • F5 BIG-IP vulnerabilities leveraged by attackers: What to do?Help Net Security

    The two BIG-IP vulnerabilities (CVE-2023-46747, CVE-2023-46748) F5 Networks has recently released hotfixes for are being exploited by attackers in the wild, the company has confirmed. “It is important to note that not all exploited systems may show the same indicators, and, indeed, a skilled attacker may be able to remove traces of their work. It is not possible to prove a device has not been compromised; when there is any uncertainty, you should consider the … More →

    newswww.helpnetsecurity.comNov 2, 2023, 11:00 AM
  • CISA adds two F5 BIG-IP flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    US CISA added two vulnerabilities, tracked as CVE-2023-46747 and CVE-2023-46748, in BIG-IP to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerabilities CVE-2023-46747 and CVE-2023-46748 in BIG-IP to its Known Exploited Vulnerabilities catalog. CISA has the two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The two […]

    newssecurityaffairs.comNov 1, 2023, 5:51 PM
  • Threat actors actively exploit F5 BIG-IP flaws CVE-2023-46747 and CVE-2023-46748Security Affairs

    Experts warn that threat actors started exploiting the critical flaw CVE-2023-46747 in F5 BIG-IP installs less than five days after PoC exploit disclosure. F5 this week warned customers about a critical security vulnerability, tracked as CVE-2023-46747 (CVSS 9.8), that impacts BIG-IP and could result in unauthenticated remote code execution. The vulnerability resides in the configuration […]

    newssecurityaffairs.comNov 1, 2023, 5:16 PM
  • Attackers Exploiting Critical F5 BIG-IP VulnerabilitySecurityWeek

    Exploitation of a critical vulnerability (CVE-2023-46747) in F5’s BIG-IP product started less than five days after public disclosure and PoC exploit code was published.

    newswww.securityweek.comOct 31, 2023, 2:57 PM
  • F5 fixes critical BIG-IP vulnerability, PoC is public (CVE-2023-46747)Help Net Security

    F5 Networks has released hotfixes for two vulnerabilities affecting its BIG-IP multi-purpose networking devices/modules, including a critical authentication bypass vulnerability (CVE-2023-46747) that could lead to unauthenticated remote code execution (RCE). About CVE-2023-46747 Discovered and reported by Thomas Hendrickson and Michael Weber of Praetorian Security, CVE-2023-46747 is a request smuggling bug in the Apache JServ Protocol (AJP) used by the vulnerable devices. “This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system … More →

    newswww.helpnetsecurity.comOct 30, 2023, 3:37 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence