PT-2021-15354 · F5 · F5 Advanced Web Application Firewall+1

Published 2021-09-14 · Updated 2021-09-27 · CVE-2021-23029

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 Advanced Web Application Firewall (WAF) versions 16.0.x through 16.0.1.2

Description Insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through the F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility.

Recommendations For versions 16.0.x through 16.0.1.2, update to version 16.0.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the BIG-IP ASM Configuration utility to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-23029

Affected Products

Big-Ip Configuration Utility

F5 Advanced Web Application Firewall

References · 5

• https://support.f5.com/csp/article/K52420610 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23029 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23029 · Vendor Advisory
• https://t.me/cibsecurity/28857 · Telegram Post
• https://t.me/cvenotify/20881 · Telegram Post