CVE-2021-23028

published 2021-09-14

CVE-2021-23028: On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs…

Priority P3 40 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip_advanced_waf	—	—
f5	big-ip_advanced_web_application_firewall	—	—
f5	big-ip_advanced_web_application_firewall	13.1.3.5 – 13.1.3.6	—
f5	big-ip_advanced_web_application_firewall	14.1.3.1 – 14.1.4.1	—
f5	big-ip_advanced_web_application_firewall	>= 15.1.1 < 15.1.3.1	15.1.3.1
f5	big-ip_application_security_manager	—	—
f5	big-ip_application_security_manager	13.1..3.5 – 13.1.3.6	—
f5	big-ip_application_security_manager	14.1.3.1 – 14.1.4.1	—
f5	big-ip_application_security_manager	>= 15.1.0 < 15.1.3.1	15.1.3.1
f5	big-ip_asm	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20