CVE-2021-22984
Quick assessment
Affected
n/a BIG-IP Advanced WAF & BIG-IP ASM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
F5 BIG-IP ASM是美国F5公司的一款Web应用程序防火墙（WAF），它提供安全的远程接入、保护电子邮件、简化Web接入控制，同时增强网络和应用性能。 BIG-IP ASM 存在输入验证错误漏洞，该漏洞源于可能会受到客户端和web服务器打开重定向攻击。以下产品及版本受到影响：BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-22984
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
F5 BIG-IP ASM 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
F5 BIG-IP ASM是美国F5公司的一款Web应用程序防火墙（WAF），它提供安全的远程接入、保护电子邮件、简化Web接入控制，同时增强网络和应用性能。 BIG-IP ASM 存在输入验证错误漏洞，该漏洞源于可能会受到客户端和web服务器打开重定向攻击。以下产品及版本受到影响：BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | BIG-IP Advanced WAF & BIG-IP ASM | 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2 | - |
|
II. Public POCs for CVE-2021-22984
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-22984
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-22984 (1)
-
https://support.f5.com/csp/article/K33440533 x_refsource_MISC
Same Patch Batch · n/a · 2021-02-12 · 25 CVEs total
| CVE-2021-22982 | AskF5 BIG-IP 缓冲区错误漏洞 | |
| CVE-2013-20001 | OpenZFS 安全漏洞 | |
| CVE-2021-27190 | Advisto PEEL SHOPPING 跨站脚本漏洞 | |
| CVE-2021-27205 | Telegram 信息泄露漏洞 | |
| CVE-2021-27204 | Telegram 信息泄露漏洞 | |
| CVE-2021-27187 | Sovremennye Delovye Tekhnologii FX Aggregator 安全漏洞 | |
| CVE-2021-27188 | Sovremennye Delovye Tekhnologii FX Aggregator 安全漏洞 | |
| CVE-2021-27197 | Pelco Digital Sentry Server 访问控制错误漏洞 | |
| CVE-2021-22975 | BIG-IP 安全漏洞 | |
| CVE-2021-22973 | F5 BIG-IP 缓冲区错误漏洞 | |
| CVE-2021-22974 | BIG-IP 竞争条件问题漏洞 | |
| CVE-2021-22976 | BIG-IP Advanced WAF 和 ASM 资源管理错误漏洞 | |
| CVE-2021-26751 | Nedi Consulting NeDi SQL注入漏洞 | |
| CVE-2021-22985 | BIG-IP APM 资源管理错误漏洞 | |
| CVE-2021-22981 | BIG-IP 安全漏洞 | |
| CVE-2021-22980 | Microsoft Edge 代码问题漏洞 | |
| CVE-2021-22979 | BIG-IP 跨站脚本漏洞 | |
| CVE-2021-22983 | F5 BIG-IP AFM 跨站脚本漏洞 | |
| CVE-2021-22978 | F5 BIG-IP 跨站脚本漏洞 | |
| CVE-2021-22977 | BIG-IP 安全漏洞 |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2021-22984
No comments yet