CVE-2021-23028: Input Validation
First published: Tue Sep 14 2021(Updated: )
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Big-ip Advanced Web Application Firewall | >=13.1.3.5<=13.1.3.6 | |
| F5 Big-ip Advanced Web Application Firewall | >=14.1.3.1<=14.1.4.1 | |
| F5 Big-ip Advanced Web Application Firewall | >=15.1.1<15.1.3.1 | |
| F5 Big-ip Advanced Web Application Firewall | =16.0.1 | |
| F5 BIG-IP Application Security Manager | >=13.1..3.5<=13.1.3.6 | |
| F5 BIG-IP Application Security Manager | >=14.1.3.1<=14.1.4.1 | |
| F5 BIG-IP Application Security Manager | >=15.1.0<15.1.3.1 | |
| F5 BIG-IP Application Security Manager | =16.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-23028.
What is the severity of CVE-2021-23028?
The severity of CVE-2021-23028 is high with a severity value of 7.5.
Which software versions are affected by CVE-2021-23028?
CVE-2021-23028 affects F5 Big-ip Advanced Web Application Firewall versions 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4.
What is the description of CVE-2021-23028?
CVE-2021-23028 is a vulnerability that occurs when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, allowing undisclosed requests to be made.
How can I fix CVE-2021-23028?
To fix CVE-2021-23028, update to F5 Big-ip Advanced Web Application Firewall versions 16.0.1.2, 15.1.3.1, 14.1.4.2, or 13.1.4.
- collector/nvd-index
- vendor/f5
- product/big-ip advanced web application firewall
- canonical/f5 big-ip advanced web application firewall
- product/big-ip application security manager
- canonical/f5 big-ip application security manager