CVE-2021-23002

Published Mar 31, 2021

Last updated 4 years ago

Overview

Description: When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Source: f5sirt@f5.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.5
Impact score: 3.6
Exploitability score: 0.9
Vector string: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 2.7
Impact score: 2.9
Exploitability score: 5.1
Vector string: AV:A/AC:L/Au:S/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8BBCE39D-283C-4D80-A83D-D4C94F2C4D92",
            "versionEndExcluding": "7.1.8.5",
            "versionStartIncluding": "7.1.5"
          },
          {
            "criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6CB004A6-19ED-43E4-BE0B-76A742120B7D",
            "versionEndExcluding": "7.1.9.8",
            "versionStartIncluding": "7.1.9"
          },
          {
            "criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B60E89ED-5C0A-4B21-A5C5-2F902E4A2891",
            "versionEndExcluding": "7.2.1.1",
            "versionStartIncluding": "7.2.1"
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2FBA9552-4645-4BFF-91A4-47B6A3414325",
            "versionEndIncluding": "11.6.5",
            "versionStartIncluding": "11.6.1"
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6C3B5688-0235-4D4F-A26C-440FF24A1B43",
            "versionEndIncluding": "12.1.5",
            "versionStartIncluding": "12.1.0"
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C3A0A32-E425-4939-A30D-95A046ABBABB",
            "versionEndExcluding": "13.1.3.6",
            "versionStartIncluding": "13.1.0"
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FB553A20-D521-4A32-AD49-8FFD5A95E684",
            "versionEndExcluding": "14.1.4",
            "versionStartIncluding": "14.1.0"
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6ED8C663-038B-4071-9FF9-AE609F2DA4CD",
            "versionEndExcluding": "15.1.2.1",
            "versionStartIncluding": "15.1.0"
          },
          {
            "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7706F70-BF89-480E-9AA6-3FE447375138",
            "versionEndExcluding": "16.0.1.1",
            "versionStartIncluding": "16.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References