PT-2021-15339 · F5 · Big-Ip

Published 2021-05-10 · Updated 2021-05-24 · CVE-2021-23012

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 13.1.x through 13.1.3 F5 BIG-IP versions 14.1.x through 14.1.3 F5 BIG-IP versions 15.1.x through 15.1.2 F5 BIG-IP versions 16.0.x through 16.0.0

Description The issue is related to a lack of input validation for items used in the system support functionality. This may allow users with either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP.

Recommendations For F5 BIG-IP versions 13.1.x through 13.1.3, update to version 13.1.4 or later. For F5 BIG-IP versions 14.1.x through 14.1.3, update to version 14.1.4 or later. For F5 BIG-IP versions 15.1.x through 15.1.2, update to version 15.1.3 or later. For F5 BIG-IP versions 16.0.x through 16.0.0, update to version 16.0.1.1 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-23012

Affected Products

Big-Ip

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-23012 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23012 · Vendor Advisory
• https://support.f5.com/csp/article/K04234247 · Vendor Advisory