Vulnerability-Lookup

CVE-2024-32761 (GCVE-0-2024-32761)

Vulnerability from cvelistv5 – Published: 2024-05-08 15:01 – Updated: 2026-02-03 00:38

Title

BIG-IP TMM tenants on VELOS and rSeries vulnerability

Summary

Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-08 17:23 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

f5 CNA under the mitre root

CNA scorecard B 84/100 over 87 records in the last 180 days details

References

1 reference

URL	Tags
https://my.f5.com/manage/s/article/K000139217	vendor-advisory

Impacted products

4 products

Vendor	Product	Version	CPE status
F5	BIG-IP	Unaffected: 17.1.0 , < * (custom) Unaffected: 16.1.0 , < * (custom) Affected: 15.1.0 , < 15.1.10 (custom)	guessed
f5	big-ip	Affected: 17.1.0 cpe:2.3:a:f5:big-ip:17.1.0:::::::*
f5	big-ip	Affected: 16.1.0 cpe:2.3:a:f5:big-ip:-:::::::*
f5	big-ip	Affected: 15.1.0 cpe:2.3:a:f5:big-ip:-:::::::*

Date Public

2024-05-08 14:00

Credits

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:f5:big-ip:17.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "big-ip",
            "vendor": "f5",
            "versions": [
              {
                "status": "affected",
                "version": "17.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "big-ip",
            "vendor": "f5",
            "versions": [
              {
                "status": "affected",
                "version": "16.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "big-ip",
            "vendor": "f5",
            "versions": [
              {
                "status": "affected",
                "version": "15.1.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-08T17:23:59.840022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:52:21.071Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:20:35.197Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://my.f5.com/manage/s/article/K000139217"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "All Modules"
          ],
          "product": "BIG-IP",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "17.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "16.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.1.10",
              "status": "affected",
              "version": "15.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5"
        }
      ],
      "datePublic": "2024-05-08T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnder certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.\u003c/span\u003e\u003c/span\u003e\u0026nbsp; Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
            }
          ],
          "value": "Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T00:38:44.961Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000139217"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "BIG-IP TMM tenants on VELOS and rSeries vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2024-32761",
    "datePublished": "2024-05-08T15:01:29.122Z",
    "dateReserved": "2024-04-24T21:34:51.149Z",
    "dateUpdated": "2026-02-03T00:38:44.961Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-32761",
      "date": "2026-10-28",
      "epss": "0.00461",
      "percentile": "0.39858"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "modules": [
                  "All Modules"
                ],
                "product": "BIG-IP",
                "vendor": "F5",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "17.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "16.1.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "15.1.10",
                    "status": "affected",
                    "version": "15.1.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "f5sirt@f5.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:f5:big-ip:17.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "big-ip",
                "vendor": "f5",
                "versions": [
                  {
                    "status": "affected",
                    "version": "17.1.0"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "big-ip",
                "vendor": "f5",
                "versions": [
                  {
                    "status": "affected",
                    "version": "16.1.0"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "big-ip",
                "vendor": "f5",
                "versions": [
                  {
                    "status": "affected",
                    "version": "15.1.0"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3EF0B216-5E0A-49E8-9373-08EEADFCD948",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "34F4B0D8-1C50-44BB-94AC-574C931CA7D1",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "543833C9-FAFA-43B8-A9E9-E47CB271097E",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EEF02906-F04F-404D-A7B7-98DCDC5FB1C5",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CD1744A9-5D9B-462D-A5F4-B69DE7BD82C4",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13EFCE4E-D726-40C7-910D-B160FCD39EF1",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33A2F791-F4A3-49B6-BFCE-26D1F90DA788",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4433F558-F29F-40B5-9DD1-7951D75D068C",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B8522A3F-7427-45F8-956D-6F9D4EB27C29",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF3F5A5B-CE24-429F-8CF9-2FCA78903045",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2DBAA855-8390-434A-BA47-1C97C7E2AA53",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9BCDFFF2-A3FC-4B8A-811D-2FDB51447AAA",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8439CD71-424E-441E-9B40-280CF618B5AB",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A11CF222-4C1E-4057-884C-95A197BD21B9",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "213D321C-E1C0-419F-8A85-8A9F539A0CC6",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "075B81B5-EBC4-4CD6-8520-C77921178188",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4F7BD21-CD0D-4F42-A631-907196FBC4B0",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2CE7BE9F-C8CD-40C3-B728-C2FE7F861C9A",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "27BCD099-2248-4F08-BDB6-BE6B3D46CECA",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BEF3F629-3A66-49A9-8B29-FE659FC9969C",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DC11AB36-DE5A-4D91-9F4A-9A452D99E996",
                    "versionEndExcluding": "15.1.10",
                    "versionStartIncluding": "15.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
          },
          {
            "lang": "es",
            "value": "Bajo ciertas condiciones, puede producirse una fuga de datos en los Microkernels de Gesti\u00f3n de Tr\u00e1fico (TMM) de los tenants de BIG-IP que se ejecutan en plataformas VELOS y rSeries. Esta fuga se produce de forma aleatoria y no puede ser provocada deliberadamente. Si se produce, puede filtrar hasta 64 bytes de bytes aleatorios no contiguos. En raras ocasiones, esto puede provocar un reinicio del TMM, lo que afecta a la disponibilidad. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no se eval\u00faan."
          }
        ],
        "id": "CVE-2024-32761",
        "lastModified": "2026-06-17T07:30:23.057",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.2,
              "source": "f5sirt@f5.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-32761",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-08T17:23:59.840022Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-08T15:15:10.330",
        "references": [
          {
            "source": "f5sirt@f5.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://my.f5.com/manage/s/article/K000139217"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://my.f5.com/manage/s/article/K000139217"
          }
        ],
        "sourceIdentifier": "f5sirt@f5.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              }
            ],
            "source": "f5sirt@f5.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-02-03T03:11:48+00:00",
      "cve": "CVE-2024-32761",
      "id": "CVE-2024-32761",
      "initial_release_date": "2024-05-08T14:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "BIG-IP TMM tenants on VELOS and rSeries vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-32761.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T02:20:35.197Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "vendor-advisory",
                  "x_transferred"
                ],
                "url": "https://my.f5.com/manage/s/article/K000139217"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:f5:big-ip:15.1.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "big-ip",
                "vendor": "f5",
                "versions": [
                  {
                    "status": "affected",
                    "version": "15.1.0"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-32761",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-08T17:23:59.840022Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-08T17:23:34.202Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "modules": [
                "All Modules"
              ],
              "product": "BIG-IP",
              "vendor": "F5",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "17.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "16.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "15.1.10",
                  "status": "affected",
                  "version": "15.1.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "F5"
            }
          ],
          "datePublic": "2024-05-08T14:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUnder certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.\u003c/span\u003e\u003c/span\u003e\u0026nbsp; Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
                }
              ],
              "value": "Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-119",
                  "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-02-03T00:38:44.961Z",
            "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
            "shortName": "f5"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://my.f5.com/manage/s/article/K000139217"
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "BIG-IP TMM tenants on VELOS and rSeries vulnerability",
          "x_generator": {
            "engine": "F5 SIRTBot v1.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "assignerShortName": "f5",
        "cveId": "CVE-2024-32761",
        "datePublished": "2024-05-08T15:01:29.122Z",
        "dateReserved": "2024-04-24T21:34:51.149Z",
        "dateUpdated": "2026-02-03T00:38:44.961Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2024-AVI-0377

Vulnerability from certfr_avis - Published: 2024-05-10 - Updated: 2024-05-10

De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
F5	BIG-IP Next	BIG-IP Next Central Manager versions 20.0.x antérieures à 20.2.0
F5	BIG-IP	BIG-IP AFM versions 17.0.x antérieures à 17.1.1
F5	BIG-IP	BIG-IP AFM versions antérieures à 16.1.4
F5	BIG-IP	BIG-IP APM versions 16.1.x antérieures à 16.1.4.2
F5	N/A	APM Clients versions postérieures à 7.2.3 et antérieures à 7.2.4.4
F5	BIG-IP Next	BIG-IP Next CNF versions antérieures à 1.3.0
F5	BIG-IP	BIG-IP "tous les autres modules" versions 15.1.x antérieures à 15.1.5.1
F5	BIG-IP	BIG-IP "tous les autres modules" versions 16.1.x antérieures à 16.1.2.2
F5	BIG-IP	BIG-IP versions 15.1.x antérieures à 15.1.10.4
F5	BIG-IP	BIG-IP Advanced WAF/ASM versions 17.1.x antérieures à 17.1.3
F5	BIG-IP	BIG-IP APM versions 15.1.x antérieures à 15.1.10.3
F5	BIG-IP	BIG-IP APM versions 17.1.x antérieures à 17.1.1
F5	BIG-IP	BIG-IP Advanced WAF/ASM versions 15.1.x antérieures à 15.1.10.4
F5	BIG-IP	BIG-IP versions 16.1.x antérieures à 16.1.4.3
F5	BIG-IP Next	BIG-IP Next SPK versions antérieures à 1.7.0
F5	BIG-IP	BIG-IP Advanced WAF/ASM versions 16.1.x antérieures à 16.1.4.3
F5	BIG-IP Next	BIG-IP Next WAF versions 20.0.x antérieures à 20.2.0
F5	BIG-IP	BIG-IP AFM versions 15.1.x antérieures à 15.1.10.4
F5	NGINX	NGINX App Protect WAF versions antérieures à 4.8.1
F5	BIG-IP	BIG-IP versions 17.1.x antérieures à 17.1.3

References

Title

Publication Time

CNVD-2024-22214

Vulnerability from cnvd - Published: 2024-05-11

Title

F5 VELOS和rSeries上的BIG-IP TMM租户数据泄露漏洞

Description

F5 BIG-IP是美国F5公司的一款集成了网络流量管理、应用程序安全管理、负载均衡等功能的应用交付平台。 F5 VELOS和rSeries上的BIG-IP TMM租户存在数据泄露漏洞，该漏洞源于在某些情况下，在VELOS和rSeries平台上运行的BIG-IP租户的流量管理微内核 (TMM) 中，攻击者可利用该漏洞导致数据泄露。

Severity

中

Patch Name

F5 VELOS和rSeries上的BIG-IP TMM租户数据泄露漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://my.f5.com/manage/s/article/K000139217

Reference

https://my.f5.com/manage/s/article/K000139217

Impacted products

Name
F5 BIG-IP (all modules) >=15.1.0，<=15.1.9

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-32761"
    }
  },
  "description": "F5 BIG-IP\u662f\u7f8e\u56fdF5\u516c\u53f8\u7684\u4e00\u6b3e\u96c6\u6210\u4e86\u7f51\u7edc\u6d41\u91cf\u7ba1\u7406\u3001\u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u7ba1\u7406\u3001\u8d1f\u8f7d\u5747\u8861\u7b49\u529f\u80fd\u7684\u5e94\u7528\u4ea4\u4ed8\u5e73\u53f0\u3002\n\nF5 VELOS\u548crSeries\u4e0a\u7684BIG-IP TMM\u79df\u6237\u5b58\u5728\u6570\u636e\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u5728VELOS\u548crSeries\u5e73\u53f0\u4e0a\u8fd0\u884c\u7684BIG-IP\u79df\u6237\u7684\u6d41\u91cf\u7ba1\u7406\u5fae\u5185\u6838 (TMM) \u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6570\u636e\u6cc4\u9732\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://my.f5.com/manage/s/article/K000139217",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-22214",
  "openTime": "2024-05-11",
  "patchDescription": "F5 BIG-IP\u662f\u7f8e\u56fdF5\u516c\u53f8\u7684\u4e00\u6b3e\u96c6\u6210\u4e86\u7f51\u7edc\u6d41\u91cf\u7ba1\u7406\u3001\u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u7ba1\u7406\u3001\u8d1f\u8f7d\u5747\u8861\u7b49\u529f\u80fd\u7684\u5e94\u7528\u4ea4\u4ed8\u5e73\u53f0\u3002\r\n\r\nF5 VELOS\u548crSeries\u4e0a\u7684BIG-IP TMM\u79df\u6237\u5b58\u5728\u6570\u636e\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u5728VELOS\u548crSeries\u5e73\u53f0\u4e0a\u8fd0\u884c\u7684BIG-IP\u79df\u6237\u7684\u6d41\u91cf\u7ba1\u7406\u5fae\u5185\u6838 (TMM) \u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u6570\u636e\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "F5 VELOS\u548crSeries\u4e0a\u7684BIG-IP TMM\u79df\u6237\u6570\u636e\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "F5 BIG-IP (all modules) \u003e=15.1.0\uff0c\u003c=15.1.9"
  },
  "referenceLink": "https://my.f5.com/manage/s/article/K000139217",
  "serverity": "\u4e2d",
  "submitTime": "2024-05-11",
  "title": "F5 VELOS\u548crSeries\u4e0a\u7684BIG-IP TMM\u79df\u6237\u6570\u636e\u6cc4\u9732\u6f0f\u6d1e"
}

FKIE_CVE-2024-32761

Vulnerability from fkie_nvd - Published: 2024-05-08 15:15 - Updated: 2026-06-17 07:30

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Summary

References

	URL	Tags
	f5sirt@f5.com	https://my.f5.com/manage/s/article/K000139217	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://my.f5.com/manage/s/article/K000139217	Vendor Advisory

Impacted products

Vendor	Product	Version
f5	big-ip_access_policy_manager	*
f5	big-ip_advanced_firewall_manager	*
f5	big-ip_advanced_web_application_firewall	*
f5	big-ip_analytics	*
f5	big-ip_application_acceleration_manager	*
f5	big-ip_application_security_manager	*
f5	big-ip_application_visibility_and_reporting	*
f5	big-ip_automation_toolchain	*
f5	big-ip_carrier-grade_nat	*
f5	big-ip_container_ingress_services	*
f5	big-ip_ddos_hybrid_defender	*
f5	big-ip_domain_name_system	*
f5	big-ip_edge_gateway	*
f5	big-ip_fraud_protection_service	*
f5	big-ip_global_traffic_manager	*
f5	big-ip_link_controller	*
f5	big-ip_local_traffic_manager	*
f5	big-ip_policy_enforcement_manager	*
f5	big-ip_ssl_orchestrator	*
f5	big-ip_webaccelerator	*
f5	big-ip_websafe	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "All Modules"
          ],
          "product": "BIG-IP",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "17.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "16.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.1.10",
              "status": "affected",
              "version": "15.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:f5:big-ip:17.1.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "big-ip",
          "vendor": "f5",
          "versions": [
            {
              "status": "affected",
              "version": "17.1.0"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "big-ip",
          "vendor": "f5",
          "versions": [
            {
              "status": "affected",
              "version": "16.1.0"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "big-ip",
          "vendor": "f5",
          "versions": [
            {
              "status": "affected",
              "version": "15.1.0"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3EF0B216-5E0A-49E8-9373-08EEADFCD948",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "34F4B0D8-1C50-44BB-94AC-574C931CA7D1",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "543833C9-FAFA-43B8-A9E9-E47CB271097E",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEF02906-F04F-404D-A7B7-98DCDC5FB1C5",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD1744A9-5D9B-462D-A5F4-B69DE7BD82C4",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13EFCE4E-D726-40C7-910D-B160FCD39EF1",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33A2F791-F4A3-49B6-BFCE-26D1F90DA788",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4433F558-F29F-40B5-9DD1-7951D75D068C",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8522A3F-7427-45F8-956D-6F9D4EB27C29",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF3F5A5B-CE24-429F-8CF9-2FCA78903045",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2DBAA855-8390-434A-BA47-1C97C7E2AA53",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BCDFFF2-A3FC-4B8A-811D-2FDB51447AAA",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8439CD71-424E-441E-9B40-280CF618B5AB",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A11CF222-4C1E-4057-884C-95A197BD21B9",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "213D321C-E1C0-419F-8A85-8A9F539A0CC6",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "075B81B5-EBC4-4CD6-8520-C77921178188",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B4F7BD21-CD0D-4F42-A631-907196FBC4B0",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CE7BE9F-C8CD-40C3-B728-C2FE7F861C9A",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27BCD099-2248-4F08-BDB6-BE6B3D46CECA",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEF3F629-3A66-49A9-8B29-FE659FC9969C",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC11AB36-DE5A-4D91-9F4A-9A452D99E996",
              "versionEndExcluding": "15.1.10",
              "versionStartIncluding": "15.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
    },
    {
      "lang": "es",
      "value": "Bajo ciertas condiciones, puede producirse una fuga de datos en los Microkernels de Gesti\u00f3n de Tr\u00e1fico (TMM) de los tenants de BIG-IP que se ejecutan en plataformas VELOS y rSeries. Esta fuga se produce de forma aleatoria y no puede ser provocada deliberadamente. Si se produce, puede filtrar hasta 64 bytes de bytes aleatorios no contiguos. En raras ocasiones, esto puede provocar un reinicio del TMM, lo que afecta a la disponibilidad. Nota: Las versiones de software que han alcanzado el Fin del Soporte T\u00e9cnico (EoTS) no se eval\u00faan."
    }
  ],
  "id": "CVE-2024-32761",
  "lastModified": "2026-06-17T07:30:23.057",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32761",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-08T17:23:59.840022Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-08T15:15:10.330",
  "references": [
    {
      "source": "f5sirt@f5.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://my.f5.com/manage/s/article/K000139217"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://my.f5.com/manage/s/article/K000139217"
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "f5sirt@f5.com",
      "type": "Secondary"
    }
  ]
}

GHSA-V5MC-FFGC-F77V

Vulnerability from github – Published: 2024-05-08 15:30 – Updated: 2026-02-03 03:30

Details

Under certain conditions, a potential data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. However, this issue cannot be exploited by an attacker because it is not consistently reproducible and is beyond an attacker's control. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-32761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-08T15:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Under certain conditions, a potential data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. However, this issue cannot be exploited by an attacker because it is not consistently reproducible and is beyond an attacker\u0027s control.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
  "id": "GHSA-v5mc-ffgc-f77v",
  "modified": "2026-02-03T03:30:25Z",
  "published": "2024-05-08T15:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32761"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000139217"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-32761

Vulnerability from gsd - Updated: 2024-04-25 05:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-32761

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-32761"
      ],
      "id": "GSD-2024-32761",
      "modified": "2024-04-25T05:02:07.707336Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-32761",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

WID-SEC-W-2024-1075

Vulnerability from csaf_certbund - Published: 2024-05-08 22:00 - Updated: 2024-05-12 22:00

Summary

F5 BIG-IP: Mehrere Schwachstellen

Severity

Kritisch

Scope

13 vulnerabilities in this advisory, including CVE-2024-32761.

CVE-2024-32761

In F5 BIG-IP existieren mehrere Schwachstellen. Die Fehler bestehen in den Komponenten TMM und Global Server Load Balancing (GSLB) Container. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen. Das erfolgreiche Ausnutzen einer dieser Schwachstellen erfordert erhöhte Rechte.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-32761 (GCVE-0-2024-32761)

CERTFR-2024-AVI-0377

Solution

CNVD-2024-22214

FKIE_CVE-2024-32761

GHSA-V5MC-FFGC-F77V

GSD-2024-32761

WID-SEC-W-2024-1075

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour