F5 addressed a flaw in BIG
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-23037 | On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed pag On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. NVD description · AI analysis pending | 9.6 group max | <1% |
| — | ||
| CVE-2021-23031 | On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an auth On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, an authenticated user may perform a privilege escalation on the BIG-IP Advanced WAF and ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. NVD description · AI analysis pending | 9.9 group max | 2% |
| — | ||
| CVE-2021-23032 | On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured wit On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS system is configured with non-default Wide IP and pool settings, undisclosed DNS responses can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. NVD description · AI analysis pending | 7.5 | <1% |
| — |
Full article690 words · extracted from securityaffairs.com · click to collapse
F5 has addressed more than a dozen severe vulnerabilities in its BIG-IP networking device, including one rated as critical severity under specific conditions.
Security vendor F5 has addressed more than a dozen high-severity vulnerabilities in its BIG-IP networking device, including an issue that was considered as critical severity when exploited under specific conditions.
The flaw, tracked as CVE-2021-23031, is a privilege escalation issue on BIG-IP Advanced Web Application Firewall (WAF) and Application Security Manager (ASM) Traffic Management User Interface (TMUI).
An authenticated attacker with access to the Configuration utility can trigger the flaw to execute arbitrary system commands, create or delete files, and/or disable services. The issue could allow an attacker to completely compromise the network device.
The flaw received a severity score of 8.8, but according to the security advisory, for customers using the Appliance Mode, which applies some technical restrictions, the severity score raises to 9.9 out of 10.
According to the security advisory for CVE-2021-23031, only a limited number of customers are impacted by the issue in a critical mode.
“When this vulnerability is exploited, an authenticated attacker with access to the Configuration utility can execute arbitrary system commands, create or delete files, and/or disable services. This vulnerability may result in complete system compromise.” reads the advisory. “The limited number of customers using Appliance mode have Scope: Changed, which raises the CVSSv3 score to 9.9. For information about Appliance mode, refer to K12815: Overview of Appliance mode.”
The vendor recommends updating the device, where it is not possible admins should limit access to the Configuration utility only to completely trusted users.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also released a security advisory encouraging users and administrators to review the F5 security advisory and install updated software or apply the necessary mitigations as soon as possible.
F5 addressed high-severity 30 vulnerabilities in multiple products, they include authenticated remote command execution flaws, cross-site scripting (XSS) issues, request forgery bugs, along insufficient permission and denial-of-service flaws.
The flaws received a severity score between 7.2 and 7.5. Below is the list of issues fixed by the vendor:
| CVE / Bug ID | Severity | CVSS score | Affected products | Affected versions | Fixes introduced in |
| CVE-2021-23025 | High | 7.2 | BIG-IP (all modules) | 15.0.0 – 15.1.0 14.1.0 – 14.1.3 13.1.0 – 13.1.3 12.1.0 – 12.1.6 11.6.1 – 11.6.5 | 16.0.0 15.1.0.5 14.1.3.1 13.1.3.5 |
| CVE-2021-23026 | High | 7.5 | BIG-IP (all modules) | 16.0.0 – 16.0.1 15.1.0 – 15.1.2 14.1.0 – 14.1.4 13.1.0 – 13.1.4 12.1.0 – 12.1.6 11.6.1 – 11.6.5 | 16.1.0 16.0.1.2 15.1.3 14.1.4.2 13.1.4.1 |
| BIG-IQ | 8.0.0 – 8.1.0 7.0.0 – 7.1.0 6.0.0 – 6.1.0 | None | |||
| CVE-2021-23027 | High | 7.5 | BIG-IP (all modules) | 16.0.0 – 16.0.1 15.1.0 – 15.1.2 14.1.0 – 14.1.4 | 16.1.0 16.0.1.2 15.1.3.1 14.1.4.3 |
| CVE-2021-23028 | High | 7.5 | BIG-IP (Advanced WAF, ASM) | 16.0.0 – 16.0.1 15.1.0 – 15.1.3 14.1.0 – 14.1.4 13.1.0 – 13.1.3 | 16.1.0 16.0.1.2 15.1.3.1 14.1.4.2 13.1.4 |
| CVE-2021-23029 | High | 7.5 | BIG-IP (Advanced WAF, ASM) | 16.0.0 – 16.0.1 | 16.1.0 16.0.1.2 |
| CVE-2021-23030 | High | 7.5 | BIG-IP (Advanced WAF, ASM) | 16.0.0 – 16.0.1 15.1.0 – 15.1.3 14.1.0 – 14.1.4 13.1.0 – 13.1.4 12.1.0 – 12.1.6 | 16.1.0 16.0.1.2 15.1.3.1 14.1.4.3 13.1.4.1 |
| CVE-2021-23031 | High–Critical – Appliance mode only | 8.8–9.9 | BIG-IP (Advanced WAF, ASM) | 16.0.0 – 16.0.1 15.1.0 – 15.1.2 14.1.0 – 14.1.4 13.1.0 – 13.1.3 12.1.0 – 12.1.5 11.6.1 – 11.6.5 | 16.1.0 16.0.1.2 15.1.3 14.1.4.1 13.1.4 12.1.6 11.6.5.3 |
| CVE-2021-23032 | High | 7.5 | BIG-IP (DNS) | 16.0.0 – 16.0.1 15.1.0 – 15.1.3 14.1.0 – 14.1.4 13.1.0 – 13.1.4 12.1.0 – 12.1.6 | 16.1.0 15.1.3.1 14.1.4.4 |
| CVE-2021-23033 | High | 7.5 | BIG-IP (Advanced WAF, ASM) | 16.0.0 – 16.0.1 15.1.0 – 15.1.3 14.1.0 – 14.1.4 13.1.0 – 13.1.4 12.1.0 – 12.1.6 | 16.1.0 15.1.3.1 14.1.4.3 13.1.4.1 |
| CVE-2021-23034 | High | 7.5 | BIG-IP (all modules) | 16.0.0 – 16.0.1 15.1.0 – 15.1.3 | 16.1.0 15.1.3.1 |
| CVE-2021-23035 | High | 7.5 | BIG-IP (all modules) | 14.1.0 – 14.1.4 | 14.1.4.4 |
| CVE-2021-23036 | High | 7.5 | BIG-IP (Advanced WAF, ASM, DataSafe) | 16.0.0 – 16.0.1 | 16.1.0 16.0.1.2 |
| CVE-2021-23037 | High | 7.5 | BIG-IP (all modules) | 16.0.0 – 16.1.0 15.1.0 – 15.1.3 14.1.0 – 14.1.4 13.1.0 – 13.1.4 12.1.0 – 12.1.6 11.6.1 – 11.6.5 | None |
The vendor also fixed medium and low severity vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, F5 BIG-IP)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121454/security/f5-big-ip-critical-flaw.html