CVE-2021-23050: CSRF
Published Sep 14, 2021
·Updated
On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
7 affected components
F5 Big-ip Advanced Web Application Firewall>=15.1.0<15.1.3.1
F5 Big-ip Advanced Web Application Firewall>=16.0.0<16.0.1.2
F5 BIG-IP Application Security Manager>=15.1.0<15.1.3.1
F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.2
F5 Nginx App Protect>=1.0.0<=1.3.0
F5 Nginx App Protect>=2.0.0<=2.3.0
F5 Nginx App Protect>=3.0.0<3.5.0
Event History
Sep 14, 2021
CVE Published
via MITRE·12:31 PM
Data Sourced
via MITRE·12:31 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-23050.
2
Which F5 products are affected by this vulnerability?
This vulnerability affects BIG-IP Advanced WAF, BIG-IP ASM, and NGINX App Protect.
3
What is the severity of CVE-2021-23050?
The severity of CVE-2021-23050 is high with a CVSS score of 7.5.
4
How can I fix the vulnerability?
To fix this vulnerability, upgrade to the patched versions of the affected software.
5
Where can I find more information about this vulnerability?
You can find more information about this vulnerability on the F5 support website.