K74151369: Appliance Mode authenticated iControl REST vulnerability CVE-2021-23015

🗓️ 21 Feb 2023 19:56:49Reported by f5Type

f5🔗 my.f5.com👁 81 Views

Appliance Mode authenticated iControl REST vulnerability CVE-2021-23015. User with 'Administrator' role may bypass restrictions

Reporter	Title	Published	Views	Family All 10
CNNVD	F5 BIG-IP 访问控制错误漏洞	29 Apr 202100:00	–	cnnvd
CVE	CVE-2021-23015	10 May 202114:40	–	cve
Cvelist	CVE-2021-23015	10 May 202114:40	–	cvelist
EUVD	EUVD-2021-10133	7 Oct 202500:30	–	euvd
F5 Networks	K96639388: Overview of F5 vulnerabilities (April 2021)	21 Feb 202319:42	–	f5
Tenable Nessus	F5 Networks BIG-IP : Appliance Mode authenticated iControl REST vulnerability (K74151369)	28 Oct 202100:00	–	nessus
NCSC	Vulnerabilities fixed in F5 BIG-IP	29 Apr 202100:00	–	ncsc
NVD	CVE-2021-23015	10 May 202115:15	–	nvd
Prion	Authentication flaw	10 May 202115:15	–	prion
RedhatCVE	CVE-2021-23015	22 May 202519:17	–	redhatcve

Vulners

Node

f5 big-ip_aamRange16.0.0–16.0.1

OR

f5 big-ip_afmRange16.0.0–16.0.1

OR

f5 big-ip_analyticsRange16.0.0–16.0.1

OR

f5 big-ip_apmRange16.0.0–16.0.1

OR

f5 big-ip_asmRange16.0.0–16.0.1

OR

f5 big-ip_ddos_hybrid_defenderRange16.0.0–16.0.1

OR

f5 big-ip_dnsRange16.0.0–16.0.1

OR

f5 big-ip_fpsRange16.0.0–16.0.1

OR

f5 big-ip_gtmRange16.0.0–16.0.1

OR

f5 big-ip_link_controllerRange16.0.0–16.0.1

OR

f5 big-ip_ltmRange16.0.0–16.0.1

OR

f5 big-ip_pemRange16.0.0–16.0.1

OR

f5 big-ip_ssl_orchestratorRange16.0.0–16.0.1

OR

f5 big-ip_aamRange15.1.0–15.1.2

OR

f5 big-ip_afmRange15.1.0–15.1.2

OR

f5 big-ip_analyticsRange15.1.0–15.1.2

OR

f5 big-ip_apmRange15.1.0–15.1.2

OR

f5 big-ip_asmRange15.1.0–15.1.2

OR

f5 big-ip_ddos_hybrid_defenderRange15.1.0–15.1.2

OR

f5 big-ip_dnsRange15.1.0–15.1.2

OR

f5 big-ip_fpsRange15.1.0–15.1.2

OR

f5 big-ip_gtmRange15.1.0–15.1.2

OR

f5 big-ip_link_controllerRange15.1.0–15.1.2

OR

f5 big-ip_ltmRange15.1.0–15.1.2

OR

f5 big-ip_pemRange15.1.0–15.1.2

OR

f5 big-ip_ssl_orchestratorRange15.1.0–15.1.2

OR

f5 big-ip_aamRange14.1.0–14.1.4

OR

f5 big-ip_afmRange14.1.0–14.1.4

OR

f5 big-ip_analyticsRange14.1.0–14.1.4

OR

f5 big-ip_apmRange14.1.0–14.1.4

OR

f5 big-ip_asmRange14.1.0–14.1.4

OR

f5 big-ip_ddos_hybrid_defenderRange14.1.0–14.1.4

OR

f5 big-ip_dnsRange14.1.0–14.1.4

OR

f5 big-ip_fpsRange14.1.0–14.1.4

OR

f5 big-ip_gtmRange14.1.0–14.1.4

OR

f5 big-ip_link_controllerRange14.1.0–14.1.4

OR

f5 big-ip_ltmRange14.1.0–14.1.4

OR

f5 big-ip_pemRange14.1.0–14.1.4

OR

f5 big-ip_ssl_orchestratorRange14.1.0–14.1.4

OR

f5 big-ip_aamRange13.1.0.8–13.1.3

OR

f5 big-ip_afmRange13.1.0.8–13.1.3

OR

f5 big-ip_analyticsRange13.1.0.8–13.1.3

OR

f5 big-ip_apmRange13.1.0.8–13.1.3

OR

f5 big-ip_asmRange13.1.0.8–13.1.3

OR

f5 big-ip_ddos_hybrid_defenderRange13.1.0.8–13.1.3

OR

f5 big-ip_dnsRange13.1.0.8–13.1.3

OR

f5 big-ip_fpsRange13.1.0.8–13.1.3

OR

f5 big-ip_gtmRange13.1.0.8–13.1.3

OR

f5 big-ip_link_controllerRange13.1.0.8–13.1.3

OR

f5 big-ip_ltmRange13.1.0.8–13.1.3

OR

f5 big-ip_pemRange13.1.0.8–13.1.3

OR

f5 big-ip_ssl_orchestratorRange13.1.0.8–13.1.3

21 Feb 2023 19:56Current

8.8High risk

Vulners AI Score8.8

CVSS 26.5

CVSS 3.17.2

EPSS0.0006

appliance mode icontrol rest vulnerability cve-2021-23015 administrator bypass restrictions control plane license vcmp guest instances compromise