PT-2021-15373 · Nginx+1 · Nginx App Protect+2
Published
2021-09-14
·
Updated
2021-09-27
·
CVE-2021-23050
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
F5 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x through 15.1.2
F5 BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x through 16.0.1.1
NGINX App Protect versions prior to 3.5.0
Description
The issue arises when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server. An undisclosed HTML response may cause the bd process to terminate.
Recommendations
For F5 BIG-IP Advanced WAF and BIG-IP ASM versions 15.1.x through 15.1.2, update to version 15.1.3 or later.
For F5 BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x through 16.0.1.1, update to version 16.0.1.2 or later.
For NGINX App Protect versions prior to 3.5.0, update to version 3.5.0 or later.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
F5 Big-Ip Apm
F5 Big-Ip Advanced Waf
Nginx App Protect