QID 375687

Date Published: 2021-11-15

QID 375687: F5 BIG-IP Access Policy Manager (APM) ACL Bypass Vulnerability (K75540265)

F5 BIG-IP Access Policy Manager (APM) is a secure, flexible, high-performance solution that provides unified global access to your network, cloud, and applications.

An attacker may be able to bypass APM's internal restrictions and retrieve static content that is hosted within APM by sending specifically crafted requests to an APM Virtual Server. CVE-2021-23016

Vulnerable Component: BIG-IP APM

Affected Versions:
16.0.0 - 16.0.1
15.1.0 - 15.1.2
14.1.0 - 14.1.4
13.1.0 - 13.1.3
12.1.0 - 12.1.5
12.1.0 - 12.1.6
11.6.1 - 11.6.5

QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.

This vulnerability may allow an attacker to retrieve static content hosted on the BIG-IP system that they would otherwise not be able to, allowing them to more effectively fingerprint a device. It does not allow any modification of data nor the exposure of any sensitive information or personally identifiable information (PII) in the standard, default, or recommended configurations.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

The vendor has released patch for several versions, for more information please visit: K75540265

Vendor References

K75540265 - support.f5.com/csp/article/K75540265

CVEs related to QID 375687

CVE-2021-23016 |

Software Advisories

Advisory ID	Software	Component	Link
K75540265			support.f5.com/csp/article/K75540265

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].