CVE-2021-23031

Published: Sep 14, 2021Modified: Nov 21, 2024

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an authenticated user may perform a privilege escalation on the BIG-IP Advanced WAF and ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (12)

Products: F5: Big Ip Advanced Web Application Firewall, Big Ip Application Security Manager

2 products

Big Ip Advanced Web Application Firewall

Big Ip Application Security Manager

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Advanced Web Application Firewall	From 11.6.1 to 11.6.5.2
F5 Big Ip Advanced Web Application Firewall	From 12.1.0 to 12.1.5
F5 Big Ip Advanced Web Application Firewall	From 13.1.0 to 13.1.3
F5 Big Ip Advanced Web Application Firewall	From 14.1.0 to 14.1.4
F5 Big Ip Advanced Web Application Firewall	From 15.1.0 to 15.1.2
F5 Big Ip Advanced Web Application Firewall	From 16.0.0 to 16.0.1.1
F5 Big Ip Application Security Manager	From 11.6.1 to 11.6.5.2
F5 Big Ip Application Security Manager	From 12.1.0 to 12.1.5
F5 Big Ip Application Security Manager	From 13.1.0 to 13.1.3
F5 Big Ip Application Security Manager	From 14.1.0 to 14.1.4
F5 Big Ip Application Security Manager	From 15.1.0 to 15.1.2
F5 Big Ip Application Security Manager	From 16.0.0 to 16.0.1.1

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://support.f5.com/csp/article/K41351250

Source: f5sirt@f5.com

MitigationVendor Advisory

https://support.f5.com/csp/article/K41351250

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.