CVE-2021-23029: SSRF
On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks through F5 Advanced Web Application Firewall (WAF) and the BIG-IP ASM Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-23029?
CVE-2021-23029 is a vulnerability in F5 Big-ip Advanced Web Application Firewall (WAF) and BIG-IP Application Security Manager that allows authenticated users with guest privileges to perform Server-Side Request Forgery (SSRF) attacks.
What is the severity of CVE-2021-23029?
The severity of CVE-2021-23029 is high, with a CVSS score of 8.8.
Which software versions are affected by CVE-2021-23029?
Versions 16.0.x before 16.0.1.2 of F5 Big-ip Advanced Web Application Firewall and BIG-IP Application Security Manager are affected by CVE-2021-23029.
What is Server-Side Request Forgery (SSRF) attack?
Server-Side Request Forgery (SSRF) attack is a type of vulnerability that allows an attacker to send crafted requests from a vulnerable server, potentially accessing internal resources or causing other malicious actions.
How can I fix CVE-2021-23029?
To fix CVE-2021-23029, update your F5 Big-ip Advanced Web Application Firewall and BIG-IP Application Security Manager to version 16.0.1.2 or later.