CVE-2021-23014 — Missing Authorization in F5 Big-ip Advanced WEB Application Firewall

CWE-862 — Missing Authorization4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.3%
top 48.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
F5 Big-ip Advanced WEB Application FirewallF5 Big-ip Application Security ManagerBig-ip ASM Advanced WAF
Timeline
PublishedMay 10
Latest updateMay 24

Description

On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5big-ip_asm/advanced_waf16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4

🔴Vulnerability Details

2
GHSA
GHSA-f4w3-762f-pwx9: On versions 16↗2022-05-24
▶
CVEList
CVE-2021-23014: On versions 16↗2021-05-10
▶

📋Vendor Advisories

1
F5
CVE-2021-23014: On versions 16↗2021-05-10
▶
CVE-2021-23014 — Missing Authorization in F5 | cvebase