CVE-2021-23043
Published on: 09/14/2021 12:00:00 AM UTC
Last Modified on: 09/24/2021 05:52:00 PM UTC
Certain versions of Big-ip Access Policy Manager from F5 contain the following vulnerability:
On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2021-23043 has been assigned by
[email protected] to track the vulnerability - currently rated as MEDIUM severity.
CVSS3 Score: 6.5 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | NONE | NONE |
CVSS2 Score: 4 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | SINGLE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | NONE | NONE |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| No Description Provided | support.f5.com text/html |
MISC support.f5.com/csp/article/K63163637 |
Related QID Numbers
- 375906 F5 BIG-IP Application Security Manager (ASM), Local Traffic Manager (LTM), Access Policy Manager (APM) Traffic Management User Interface (TMUI) Vulnerability (K63163637)
Known Affected Configurations (CPE V2.3)
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @softek_jp |
F5 Networks BIG-IP の TMUI の処理に web root 内の任意のファイルを読み取られる問題 (CVE-2021-23043) [39834] sid.softek.jp/content/show/3… #SIDfm #脆弱性情報 | 2021-08-27 09:12:56 |