Lucene search

K
cve[email protected]CVE-2021-23002
HistoryMar 31, 2021 - 6:15 p.m.

CVE-2021-23002

2021-03-3118:15:15
web.nvd.nist.gov
27
cve-2021-23002
big-ip apm
vpn
windows
security vulnerability
session id
nvd

4.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

2.7 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.5%

When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected configurations

NVD
Node
f5access_policy_manager_clientsRange7.1.57.1.8.5
OR
f5access_policy_manager_clientsRange7.1.97.1.9.8
OR
f5access_policy_manager_clientsRange7.2.17.2.1.1
OR
f5big-ip_access_policy_managerRange11.6.111.6.5
OR
f5big-ip_access_policy_managerRange12.1.012.1.5
OR
f5big-ip_access_policy_managerRange13.1.013.1.3.6
OR
f5big-ip_access_policy_managerRange14.1.014.1.4
OR
f5big-ip_access_policy_managerRange15.1.015.1.2.1
OR
f5big-ip_access_policy_managerRange16.0.016.0.1.1

CNA Affected

[
  {
    "product": "BIG-IP APM and Edge Client",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, all 12.1.x and 11.6.x versions"
      },
      {
        "status": "affected",
        "version": "Edge Client 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, 7.1.8.x before 7.1.8.5"
      }
    ]
  }
]

4.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.3 Medium

AI Score

Confidence

High

2.7 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.5%

Related for CVE-2021-23002