CVE-2021-23028: Input Validation
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, undisclosed requests may cause the BIG-IP ASM bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-23028.
What is the severity of CVE-2021-23028?
The severity of CVE-2021-23028 is high with a severity value of 7.5.
Which software versions are affected by CVE-2021-23028?
CVE-2021-23028 affects F5 Big-ip Advanced Web Application Firewall versions 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4.
What is the description of CVE-2021-23028?
CVE-2021-23028 is a vulnerability that occurs when JSON content profiles are configured for URLs as part of an F5 Advanced Web Application Firewall (WAF)/BIG-IP ASM security policy and applied to a virtual server, allowing undisclosed requests to be made.
How can I fix CVE-2021-23028?
To fix CVE-2021-23028, update to F5 Big-ip Advanced Web Application Firewall versions 16.0.1.2, 15.1.3.1, 14.1.4.2, or 13.1.4.