CVE-2021-22988: Critical severity F5 BIG-IP Access Policy Manager vulnerability
Published Mar 31, 2021
·Updated
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Affected Software
84 affected components
F5 BIG-IP Access Policy Manager>=11.6.1<11.6.5.3
F5 BIG-IP Access Policy Manager>=12.1.0<12.1.5.3
F5 BIG-IP Access Policy Manager>=13.1.0<13.1.3.6
F5 BIG-IP Access Policy Manager>=14.1.0<14.1.4
F5 BIG-IP Access Policy Manager>=15.1.0<15.1.2.1
F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1.1
F5 BIG-IP Advanced Firewall Manager>=11.6.1<11.6.5.3
F5 BIG-IP Advanced Firewall Manager>=12.1.0<12.1.5.3
F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.3.6
F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.4
F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.2.1
F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1.1
F5 Big-ip Advanced Web Application Firewall>=11.6.1<11.6.5.3
F5 Big-ip Advanced Web Application Firewall>=12.1.0<12.1.5.3
F5 Big-ip Advanced Web Application Firewall>=13.1.0<13.1.3.6
F5 Big-ip Advanced Web Application Firewall>=14.1.0<14.1.4
F5 Big-ip Advanced Web Application Firewall>=15.1.0<15.1.2.1
F5 Big-ip Advanced Web Application Firewall>=16.0.0<16.0.1.1
F5 BIG-IP Analytics>=11.6.1<11.6.5.3
F5 BIG-IP Analytics>=12.1.0<12.1.5.3
F5 BIG-IP Analytics>=13.1.0<13.1.3.6
F5 BIG-IP Analytics>=14.1.0<14.1.4
F5 BIG-IP Analytics>=15.1.0<15.1.2.1
F5 BIG-IP Analytics>=16.0.0<16.0.1.1
F5 Big-ip Application Acceleration Manager>=11.6.1<11.6.5.3
F5 Big-ip Application Acceleration Manager>=12.1.0<12.1.5.3
F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.3.6
F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.4
F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.2.1
F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1.1
F5 BIG-IP Application Security Manager>=11.6.1<11.6.5.3
F5 BIG-IP Application Security Manager>=12.1.0<12.1.5.3
F5 BIG-IP Application Security Manager>=13.1.0<13.1.3.6
F5 BIG-IP Application Security Manager>=14.1.0<14.1.4
F5 BIG-IP Application Security Manager>=15.1.0<15.1.2.1
F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.1
F5 Big-ip Ddos Hybrid Defender>=11.6.1<11.6.5.3
F5 Big-ip Ddos Hybrid Defender>=12.1.0<12.1.5.3
F5 Big-ip Ddos Hybrid Defender>=13.1.0<13.1.3.6
F5 Big-ip Ddos Hybrid Defender>=14.1.0<14.1.4
F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.2.1
F5 Big-ip Ddos Hybrid Defender>=16.0.0<16.0.1.1
F5 Big-ip Domain Name System>=11.6.1<11.6.5.3
F5 Big-ip Domain Name System>=12.1.0<12.1.5.3
F5 Big-ip Domain Name System>=13.1.0<13.1.3.6
F5 Big-ip Domain Name System>=14.1.0<14.1.4
F5 Big-ip Domain Name System>=15.1.0<15.1.2.1
F5 Big-ip Domain Name System>=16.0.0<16.0.1.1
F5 Big-ip Fraud Protection Service>=11.6.1<11.6.5.3
F5 Big-ip Fraud Protection Service>=12.1.0<12.1.5.3
F5 Big-ip Fraud Protection Service>=13.1.0<13.1.3.6
F5 Big-ip Fraud Protection Service>=14.1.0<14.1.4
F5 Big-ip Fraud Protection Service>=15.1.0<15.1.2.1
F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1.1
F5 Big-ip Global Traffic Manager>=11.6.1<11.6.5.3
F5 Big-ip Global Traffic Manager>=12.1.0<12.1.5.3
F5 Big-ip Global Traffic Manager>=13.1.0<13.1.3.6
F5 Big-ip Global Traffic Manager>=14.1.0<14.1.4
F5 Big-ip Global Traffic Manager>=15.1.0<15.1.2.1
F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1.1
F5 Big-ip Link Controller>=11.6.1<11.6.5.3
F5 Big-ip Link Controller>=12.1.0<12.1.5.3
F5 Big-ip Link Controller>=13.1.0<13.1.3.6
F5 Big-ip Link Controller>=14.1.0<14.1.4
F5 Big-ip Link Controller>=15.1.0<15.1.2.1
F5 Big-ip Link Controller>=16.0.0<16.0.1.1
F5 Big-ip Local Traffic Manager>=11.6.1<11.6.5.3
F5 Big-ip Local Traffic Manager>=12.1.0<12.1.5.3
F5 Big-ip Local Traffic Manager>=13.1.0<13.1.3.6
F5 Big-ip Local Traffic Manager>=14.1.0<14.1.4
F5 Big-ip Local Traffic Manager>=15.1.0<15.1.2.1
F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1.1
F5 Big-ip Policy Enforcement Manager>=11.6.1<11.6.5.3
F5 Big-ip Policy Enforcement Manager>=12.1.0<12.1.5.3
F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.3.6
F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.4
F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.2.1
F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1.1
F5 SSL Orchestrator>=11.6.1<11.6.5.3
F5 SSL Orchestrator>=12.1.0<12.1.5.3
F5 SSL Orchestrator>=13.1.0<13.1.3.6
F5 SSL Orchestrator>=14.1.0<14.1.4
F5 SSL Orchestrator>=15.1.0<15.1.2.1
F5 SSL Orchestrator>=16.0.0<16.0.1.1
Event History
Mar 31, 2021
CVE Published
via MITRE·02:03 PM
Data Sourced
via MITRE·02:03 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-22988?
CVE-2021-22988 has a moderate severity rating due to the potential for authenticated remote command execution.
2
How do I fix CVE-2021-22988?
To fix CVE-2021-22988, update the affected F5 BIG-IP products to the latest versions provided by F5.
3
Which versions of F5 BIG-IP are affected by CVE-2021-22988?
CVE-2021-22988 affects F5 BIG-IP versions prior to 16.0.1.1, 15.1.2.1, 14.1.4, 13.1.3.6, 12.1.5.3, and 11.6.5.3.
4
What products are impacted by CVE-2021-22988?
The impacted products include F5 BIG-IP Access Policy Manager, Application Security Manager, Local Traffic Manager, and others.
5
What type of vulnerability is CVE-2021-22988 classified as?
CVE-2021-22988 is classified as an authenticated remote command execution vulnerability.