CVE-2021-23028

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS v3 7.5 HIGH
CVSS v2.0 4.3 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://support.f5.com/csp/article/K00602225	Mitigation Vendor Advisory
https://support.f5.com/csp/article/K00602225	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:16.0.1:::::::*
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager:16.0.1:::::::*

History

21 Nov 2024, 05:51

Type	Values Removed	Values Added
References	~~() https://support.f5.com/csp/article/K00602225 - Mitigation, Vendor Advisory~~	() https://support.f5.com/csp/article/K00602225 - Mitigation, Vendor Advisory

Information

Published : 2021-09-14 21:15

Updated : 2024-11-21 05:51

NVD link : CVE-2021-23028

Mitre link : CVE-2021-23028

CVE.ORG link : CVE-2021-23028

JSON object : View

Products Affected

f5

big-ip_advanced_web_application_firewall
big-ip_application_security_manager

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2021-23028", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-09-14T21:15:07.663", "references": [{"url": "https://support.f5.com/csp/article/K00602225", "tags": ["Mitigation", "Vendor Advisory"], "source": "f5sirt@f5.com"}, {"url": "https://support.f5.com/csp/article/K00602225", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "f5sirt@f5.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}, {"lang": "es", "value": "En versiones 16.0.x anteriores a 16.0.1.2, versiones 15.1.x anteriores a 15.1.3.1, versiones 14.1.x anteriores a 14.1.4.2 y versiones 13.1.x anteriores a 13.1.4, cuando los perfiles de contenido JSON est\u00e1n configurados para las URL como parte de una pol\u00edtica de seguridad de F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM y se aplican a un servidor virtual, las peticiones no divulgadas pueden causar la terminaci\u00f3n del proceso de BIG-IP ASM bd. Nota: Las versiones de software que han alcanzado End of Technical Support (EoTS) no son evaluadas"}], "lastModified": "2024-11-21T05:51:10.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59EC7271-ACFA-4B83-942A-1EFC03DB8356", "versionEndIncluding": "13.1.3.6", "versionStartIncluding": "13.1.3.5"}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "751D1F9E-745A-4F1A-A776-063DE264FF48", "versionEndIncluding": "14.1.4.1", "versionStartIncluding": "14.1.3.1"}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C77478E-AFCF-4EB4-B1A6-E8268015F608", "versionEndExcluding": "15.1.3.1", "versionStartIncluding": "15.1.1"}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:16.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CB3F285-D159-4F02-A725-D50F60FBE8E6"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E809D80-6A35-4D3F-9AEB-9D49AF6419B1", "versionEndIncluding": "13.1.3.6", "versionStartIncluding": "13.1..3.5"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BCA5708-3771-47A9-A740-DEB5F038492E", "versionEndIncluding": "14.1.4.1", "versionStartIncluding": "14.1.3.1"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4B53FEB-1754-49D4-953D-146D92CAC3BF", "versionEndExcluding": "15.1.3.1", "versionStartIncluding": "15.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:16.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7119586-2C82-4876-B720-871F9483409E"}], "operator": "OR"}]}], "sourceIdentifier": "f5sirt@f5.com"}