Brute Force Protection Flaw in BIG-IP Advanced WAF and ASM by F5 Networks

CVE-2021-23053

Summary

A flaw exists in the brute force protection feature of F5 Networks' BIG-IP Advanced WAF and BIG-IP ASM. When enabled on a virtual server and subjected to a brute force attack, this vulnerability may cause the MySQL database to run out of disk space. This issue arises from a lack of row limit on certain undisclosed tables in the MySQL database, potentially leading to service disruption. Affected versions include 15.1.x prior to 15.1.3, 14.1.x prior to 14.1.3.1, and 13.1.x prior to 13.1.3.6. It's important to note that software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

References