« Volver al listado

CVE-2021-22980

Estado: ModificadaAlta (7.8)—

In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

F5 — Access Policy Manager ClientsF5 — Big-ip Access Policy Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22980",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "f5sirt@f5.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Edge Client",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-12T18:15:12.737",
  "references": [
    {
      "url": "https://support.f5.com/csp/article/K29282483",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://support.f5.com/csp/article/K29282483",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated."
    },
    {
      "lang": "es",
      "value": "En Edge Client versiones 7.2.x anteriores a 7.2.1.1, versiones 7.1.9.x anteriores 7.1.9.8 y versiones 7.1.x-7.1.8.x  anteriores a 7.1.8.5, una vulnerabilidad de ruta de búsqueda no confiable en BIG-IP APM Client Troubleshooting Utility (CTU) para Windows, podría permitir a un atacante cargar una biblioteca DLL maliciosa desde su directorio actual. Es requerida una interacción del usuario para explotar esta vulnerabilidad, ya que la víctima debe ejecutar esta utilidad en el sistema Windows. Nota: No son evaluadas las versiones de software que han alcanzado End of Software Development (EoSD)"
    }
  ],
  "lastModified": "2026-06-17T03:38:08.787",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BBCE39D-283C-4D80-A83D-D4C94F2C4D92",
              "versionEndExcluding": "7.1.8.5",
              "versionStartIncluding": "7.1.5"
            },
            {
              "criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6CB004A6-19ED-43E4-BE0B-76A742120B7D",
              "versionEndExcluding": "7.1.9.8",
              "versionStartIncluding": "7.1.9"
            },
            {
              "criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B60E89ED-5C0A-4B21-A5C5-2F902E4A2891",
              "versionEndExcluding": "7.2.1.1",
              "versionStartIncluding": "7.2.1"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FBA9552-4645-4BFF-91A4-47B6A3414325",
              "versionEndIncluding": "11.6.5",
              "versionStartIncluding": "11.6.1"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C3B5688-0235-4D4F-A26C-440FF24A1B43",
              "versionEndIncluding": "12.1.5",
              "versionStartIncluding": "12.1.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C3A0A32-E425-4939-A30D-95A046ABBABB",
              "versionEndExcluding": "13.1.3.6",
              "versionStartIncluding": "13.1.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B176513C-86DD-4DA9-AB60-1D233091A9DB",
              "versionEndIncluding": "14.1.3",
              "versionStartIncluding": "14.1.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EF8BF70-3688-4DEE-BF08-835293783996",
              "versionEndIncluding": "15.1.2",
              "versionStartIncluding": "15.1.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7706F70-BF89-480E-9AA6-3FE447375138",
              "versionEndExcluding": "16.0.1.1",
              "versionStartIncluding": "16.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com"
}