PT-2021-15324 · F5 · Big-Iq

Published 2021-03-31 · Updated 2022-07-12 · CVE-2021-22997

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IQ versions 6.x through 7.x

Description The BIG-IQ HA ElasticSearch service does not implement authentication for clustering transport services, and all data used by ElasticSearch for transport is unencrypted.

Recommendations For versions 6.x and 7.x, update to version 8.0.0 to resolve the issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-22997

Affected Products

Big-Iq

References · 4

• https://support.f5.com/csp/article/K34074377 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22997 · Security Note
• https://t.me/cvenotify/12416 · Telegram Post