PT-2021-15355 · F5 · Big-Ip Asm+1

Published 2021-09-14 · Updated 2021-09-29 · CVE-2021-23030

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF and BIG-IP ASM versions 12.1.x BIG-IP Advanced WAF and BIG-IP ASM versions 13.1.x before 13.1.4.1 BIG-IP Advanced WAF and BIG-IP ASM versions 14.1.x before 14.1.4.3 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x before 15.1.3.1 BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.2

Description When a WebSocket profile is configured on a virtual server, undisclosed requests can cause bd to terminate. This issue affects BIG-IP Advanced WAF and BIG-IP ASM.

Recommendations For versions 12.1.x, there is no information about a newer version that contains a fix for this vulnerability. For versions 13.1.x before 13.1.4.1, update to version 13.1.4.1 or later. For versions 14.1.x before 14.1.4.3, update to version 14.1.4.3 or later. For versions 15.1.x before 15.1.3.1, update to version 15.1.3.1 or later. For versions 16.0.x before 16.0.1.2, update to version 16.0.1.2 or later.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-23030

Affected Products

Big-Ip Asm

Big-Ip Advanced Waf

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-23030 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23030 · Vendor Advisory
• https://support.f5.com/csp/article/K42051445 · Vendor Advisory
• https://t.me/cibsecurity/28855 · Telegram Post
• https://t.me/cvenotify/20876 · Telegram Post
• https://t.me/cvenotify/21651 · Telegram Post
• https://t.me/cvenotify/20862 · Telegram Post