Cross-Site Request Forgery Vulnerability in F5 BIG-IP Products
CVE-2021-23050

7.5HIGH

Key Information:

Vendor
F5
Status
Big-ip Advanced Waf And Big-ip Asm; Nginx App Protect
Vendor
CVE Published:
14 September 2021

Summary

A vulnerability exists in F5 BIG-IP Advanced WAF and ASM versions prior to 16.0.1.2 and 15.1.3, along with all versions of NGINX App Protect. When a CSRF-enabled policy is configured on a virtual server, an unhandled HTML response may cause the bd process to unexpectedly terminate, resulting in potential disruption of service. It is crucial for users to upgrade to the latest versions to mitigate this risk and ensure optimal security.

Affected Version(s)

BIG-IP Advanced WAF and BIG-IP ASM; NGINX App Protect BIG-IP Advanced WAF and BIG-IP ASM 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3

BIG-IP Advanced WAF and BIG-IP ASM; NGINX App Protect NGINX App Protect all versions before 3.5.0

References

https://support.f5.com/csp/article/K44553214
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.