CVE-2021-23008
published 2021-05-10CVE-2021-23008: On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD…
PriorityP359critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.33%
67.8th percentile
On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_access_policy_manager | >= 11.5.2 < 11.6.5 | 11.6.5 |
| f5 | big-ip_access_policy_manager | >= 12.1.0 < 12.1.5 | 12.1.5 |
| f5 | big-ip_access_policy_manager | >= 13.1.0 < 13.1.3 | 13.1.3 |
| f5 | big-ip_access_policy_manager | >= 14.1.0 < 14.1.3 | 14.1.3 |
| f5 | big-ip_access_policy_manager | >= 15.0.0 < 15.1.2 | 15.1.2 |
| f5 | big-ip_access_policy_manager | >= 16.0.0 < 16.0.1 | 16.0.1 |
| f5 | big-ip_apm | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2021-23008: On version 15
vendor_f5·2021-05-10·CVSS 9.8
CVE-2021-23008 [CRITICAL] CWE-287 CVE-2021-23008: On version 15
CVE-2021-23008: On version 15
On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products: BIG-IP APM
Affected Versions: 11.5.2 - 11.6.5; 12.1.0 - 12.1.5; 13.1.0 - 13.1.3; 14.1.0 - 14.1.3; 15.0.0 - 15.1.2; 16.0.0 - 16.0.1
F5 Advisory Articles: K51213246
F5 References: https://support.f5.com/csp/article/K51213246
GHSA
GHSA-mvmv-3mv8-37fq: On version 15
ghsa_unreviewed·2022-05-24
CVE-2021-23008 [CRITICAL] CWE-287 GHSA-mvmv-3mv8-37fq: On version 15
On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD (Active Directory) authentication can be bypassed via a spoofed AS-REP (Kerberos Authentication Service Response) response sent over a hijacked KDC (Kerberos Key Distribution Center) connection or from an AD server compromised by an attacker. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-05-10
Published