PT-2021-15319 · F5 · Big-Ip

Published 2021-03-31 · Updated 2021-04-05 · CVE-2021-22990

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BIG-IP versions 16.0.x before 16.0.1.1 BIG-IP versions 15.1.x before 15.1.2.1 BIG-IP versions 14.1.x before 14.1.4 BIG-IP versions 13.1.x before 13.1.3.6 BIG-IP versions 12.1.x before 12.1.5.3 BIG-IP versions 11.6.x before 11.6.5.3

Description The Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages on systems with Advanced WAF or BIG-IP ASM provisioned.

Recommendations For BIG-IP versions 16.0.x before 16.0.1.1, update to version 16.0.1.1 or later. For BIG-IP versions 15.1.x before 15.1.2.1, update to version 15.1.2.1 or later. For BIG-IP versions 14.1.x before 14.1.4, update to version 14.1.4 or later. For BIG-IP versions 13.1.x before 13.1.3.6, update to version 13.1.3.6 or later. For BIG-IP versions 12.1.x before 12.1.5.3, update to version 12.1.5.3 or later. For BIG-IP versions 11.6.x before 11.6.5.3, update to version 11.6.5.3 or later.

Fix

Related Identifiers

CVE-2021-22990

Affected Products

Big-Ip

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-22990 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22990 · Vendor Advisory
• https://support.f5.com/csp/article/K45056101 · Vendor Advisory
• https://t.me/cvenotify/12401 · Telegram Post