« Volver al listado

CVE-2021-23050

Estado: ModificadaAlta (7.5)—

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

F5 — Big-ip Advanced WEB Application FirewallF5 — Big-ip Application Security ManagerF5 — Nginx APP Protect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-23050",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "f5sirt@f5.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "BIG-IP Advanced WAF and BIG-IP ASM; NGINX App Protect",
          "versions": [
            {
              "status": "affected",
              "version": "BIG-IP Advanced WAF and BIG-IP ASM 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3"
            },
            {
              "status": "affected",
              "version": "NGINX App Protect all versions before 3.5.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-09-14T13:15:11.093",
  "references": [
    {
      "url": "https://support.f5.com/csp/article/K44553214",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://support.f5.com/csp/article/K44553214",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "f5sirt@f5.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
    },
    {
      "lang": "es",
      "value": "En BIG-IP Advanced WAF y BIG-IP ASM versiones 16.0.x anteriores a 16.0.1.2 y versiones 15.1.x anteriores a 15.1.3 y NGINX App Protect en todas las versiones anteriores a 3.5.0, cuando es configurado una política de tipo cross-site request forgery (CSRF) en un servidor virtual, una respuesta HTML no divulgada puede causar una finalización del proceso bd. Nota: Las versiones de software que han alcanzado End of Technical Support (EoTS) no son evaluadas"
    }
  ],
  "lastModified": "2026-06-17T03:38:16.877",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59C90A98-C3A2-420D-8936-A094D3539AA2",
              "versionEndExcluding": "15.1.3.1",
              "versionStartIncluding": "15.1.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "633F777A-10B4-42B6-867C-FC32E38A4B1A",
              "versionEndExcluding": "16.0.1.2",
              "versionStartIncluding": "16.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4B53FEB-1754-49D4-953D-146D92CAC3BF",
              "versionEndExcluding": "15.1.3.1",
              "versionStartIncluding": "15.1.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE26ED82-4D38-4165-990D-4967AE130059",
              "versionEndExcluding": "16.0.1.2",
              "versionStartIncluding": "16.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_app_protect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5CB7297-C457-40B4-8643-CF59EC13865D",
              "versionEndIncluding": "1.3.0",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_app_protect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E76351C7-2FA5-4B76-87F0-4BEB5DFC73D6",
              "versionEndIncluding": "2.3.0",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_app_protect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68577A25-8EF1-4143-8E2B-08B7D983337B",
              "versionEndExcluding": "3.5.0",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com"
}