PT-2021-15328 · F5 · Big-Ip Asm+1
Published
2021-03-31
·
Updated
2021-04-05
·
CVE-2021-23001
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
BIG-IP Advanced WAF and BIG-IP ASM versions 11.6.x before 11.6.5.3
BIG-IP Advanced WAF and BIG-IP ASM versions 12.1.x before 12.1.5.3
BIG-IP Advanced WAF and BIG-IP ASM versions 13.1.x before 13.1.3.6
BIG-IP Advanced WAF and BIG-IP ASM versions 14.1.x before 14.1.4
BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x before 15.1.2.1
BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1
Description
The upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint.
Recommendations
For versions 11.6.x before 11.6.5.3, update to version 11.6.5.3 or later.
For versions 12.1.x before 12.1.5.3, update to version 12.1.5.3 or later.
For versions 13.1.x before 13.1.3.6, update to version 13.1.3.6 or later.
For versions 14.1.x before 14.1.4, update to version 14.1.4 or later.
For versions 15.1.x before 15.1.2.1, update to version 15.1.2.1 or later.
For versions 16.0.x before 16.0.1.1, update to version 16.0.1.1 or later.
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Big-Ip Asm
Big-Ip Advanced Waf