Vulnerability · Published Sep 14, 2021 · Assigned by f5
CVE-2021-23029
High 8.8
In plain English
A high-severity server-side request forgery in BIG-IP Advanced WAF and BIG-IP ASM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.9%top 40.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | BIG-IP Advanced WAF and BIG-IP ASM | 16.0.x before 16.0.1.2 |
Weakness: CWE-918
References
- https://support.f5.com/csp/article/K52420610 x_refsource_MISC