CVE-2021-22997

Published: Mar 31, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

On all 7.x and 6.x versions (fixed in 8.0.0), BIG-IQ HA ElasticSearch service does not implement any form of authentication for the clustering transport services, and all data used by ElasticSearch for transport is unencrypted. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected (1)

Products: F5: Big Iq Centralized Management

1 product

Big Iq Centralized Management

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
F5 Big Iq Centralized Management	From 6.0.0 to 8.0.0

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://support.f5.com/csp/article/K34074377

Source: f5sirt@f5.com

Vendor Advisory

https://support.f5.com/csp/article/K34074377

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.