F5 Advanced Web Application Firewall Vulnerability Affecting Multiple Versions
CVE-2021-23028
7.5HIGH
Key Information:
- Vendor
- F5
- Vendor
- CVE Published:
- 14 September 2021
Summary
In specific versions of the F5 Advanced Web Application Firewall, a vulnerability exists when JSON content profiles are configured for URLs within a security policy. This flaw can lead to the termination of the BIG-IP ASM bd process when handling undisclosed requests. As a result, it could disrupt the normal operation of the firewall, impacting the availability of web applications under its protection.
Affected Version(s)
BIG-IP Advanced WAF and BIG-IP ASM 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved