PT-2021-15343 · F5 · Big-Ip Apm

Published 2021-05-10 · Updated 2021-05-24 · CVE-2021-23016

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP APM versions 11.6.x BIG-IP APM versions 12.1.x BIG-IP APM versions 13.1.x before 13.1.4 BIG-IP APM versions 14.1.x before 14.1.4.1 BIG-IP APM versions 15.1.x before 15.1.3 BIG-IP APM versions 16.0.x

Description An issue allows an attacker to bypass internal restrictions and retrieve static content hosted within APM by sending specifically crafted requests to an APM Virtual Server.

Recommendations For BIG-IP APM version 11.6.x, there is no information about a newer version that contains a fix for this issue. For BIG-IP APM version 12.1.x, there is no information about a newer version that contains a fix for this issue. For BIG-IP APM versions 13.1.x before 13.1.4, update to version 13.1.4 or later. For BIG-IP APM versions 14.1.x before 14.1.4.1, update to version 14.1.4.1 or later. For BIG-IP APM versions 15.1.x before 15.1.3, update to version 15.1.3 or later. For BIG-IP APM versions 16.0.x, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2021-23016

Affected Products

Big-Ip Apm

References · 3

• https://osv.dev/vulnerability/CVE-2021-23016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23016 · Security Note
• https://support.f5.com/csp/article/K75540265 · Vendor Advisory