Vulnerability Name:

CVE-2021-22984 (CCN-196707)

Assigned:2021-02-10
Published:2021-02-10
Updated:2021-02-18
Summary:On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks.
Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-601
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-22984

Source: XF
Type: UNKNOWN
f5-bigip-cve202122984-open-redirection(196707)

Source: CCN
Type: F5 Security Advisory K33440533
BIG-IP ASM Bot Defense open redirection vulnerability CVE-2021-22984

Source: MISC
Type: Vendor Advisory
https://support.f5.com/csp/article/K33440533

Vulnerable Configuration:Configuration 1:
  • cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 11.6.1 and < 11.6.5.2)
  • OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.2)
  • OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.3.4)
  • OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.2.5)
  • OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 15.0.0 and < 15.0.1.4)
  • OR cpe:/a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.0.2)
  • OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 11.6.1 and < 11.6.5.2)
  • OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 12.1.0 and < 12.1.5.2)
  • OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 13.1.0 and < 13.1.3.4)
  • OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 14.1.0 and < 14.1.2.5)
  • OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 15.0.0 and < 15.0.1.4)
  • OR cpe:/a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* (Version >= 15.1.0 and < 15.1.0.2)

    • Configuration CCN 1:
  • cpe:/a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:14.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip:14.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:13.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:12.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:11.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:13.1.3:*:*:*:*:*:*:*
  • OR cpe:/o:f5:big-ip:15.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:15.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip_access_policy_manager:16.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:f5:big-ip:14.1.0:*:*:*:*:*:*:*
  • OR cpe:/o:f5:big-ip:15.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    f5 big-ip advanced web application firewall *
    f5 big-ip advanced web application firewall *
    f5 big-ip advanced web application firewall *
    f5 big-ip advanced web application firewall *
    f5 big-ip advanced web application firewall *
    f5 big-ip advanced web application firewall *
    f5 big-ip application security manager *
    f5 big-ip application security manager *
    f5 big-ip application security manager *
    f5 big-ip application security manager *
    f5 big-ip application security manager *
    f5 big-ip application security manager *
    f5 big-ip access policy manager 12.1.0
    f5 big-ip access policy manager 14.1.0
    f5 big-ip 14.1.0
    f5 big-ip access policy manager 13.1.0
    f5 big-ip access policy manager 12.1.5
    f5 big-ip access policy manager 11.6.5
    f5 big-ip access policy manager 13.1.3
    f5 big-ip 15.0.0
    f5 big-ip access policy manager 11.6.1
    f5 big-ip access policy manager 15.1.0
    f5 big-ip access policy manager 16.0.0
    f5 big-ip 14.1.0
    f5 big-ip 15.0.0