K23203045 : BIG-IP Advanced WAF and ASM REST API vulnerability CVE-2021-23014

Security Advisory Description

BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API, which might allow authenticated users with guest privileges to upload files. (CVE-2021-23014)

Impact

If an attacker has network access to the BIG-IP Advanced WAF and ASM devices and has authenticated with guest privileges, the attacker could upload files to the BIG-IP Advanced WAF and ASM devices via the REST API. This may allow the attacker to upload and overwrite a limited set of files on BIG-IP Advanced WAF and ASM systems.