CVE-2024-23976

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

When running in Appliance mode, an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing iAppsLX templates on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 17.1.0, < 17.1.1; >= 16.1.0, < 16.1.4; >= 15.1.0, < 15.1.9
f5	big-ip	>= 17.1.0, < 17.1.1; >= 16.1.0, < 16.1.4; >= 15.1.0, < 15.1.9

References

https://my.f5.com/manage/s/article/K91054692Vendor Advisory
https://my.f5.com/manage/s/article/K91054692Vendor Advisory

Timeline

Published: Feb 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-239789.8Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be exe CVE-2024-239797.5When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured on a virtual CVE-2024-23988.6When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximu CVE-2024-239807.5Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privilege CVE-2024-239818.8Wrap-around error in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before version 28.3 may allow an a CVE-2024-239827.5When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microk CVE-2024-239835.8Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.CVE-2024-239845.3Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosu CVE-2024-239857.5EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.CVE-2024-23995.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions CVE-2024-239956.1Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a CVE-2024-239979.6Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.