PT-2021-15341 · F5 · Big-Ip Advanced Waf/Asm

Published 2021-05-10 · Updated 2021-05-24 · CVE-2021-23014

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and ASM versions 14.1.x through 14.1.3 BIG-IP Advanced WAF and ASM versions 15.1.x through 15.1.2 BIG-IP Advanced WAF and ASM versions 16.0.x through 16.0.0

Description The issue concerns missing authorization checks for file uploads to a specific directory within the REST API. This might allow authenticated users with guest privileges to upload files.

Recommendations For versions 14.1.x through 14.1.3, update to version 14.1.4 or later. For versions 15.1.x through 15.1.2, update to version 15.1.3 or later. For versions 16.0.x through 16.0.0, update to version 16.0.1.1 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-23014

Affected Products

Big-Ip Advanced Waf/Asm

References · 3

• https://support.f5.com/csp/article/K23203045 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23014 · Security Note