BDU:2021-04388

Scores

EPSS

0.000None0.0%

0%20%40%60%80%100%

Percentile: 0.0%

CVSS

9.8Critical3.x

0246810

CVSS Score: 9.8/10

All CVSS Scores

CVSS 3.x

9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0

10.0

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

Уязвимость интерфейса iControl REST API средств контроля доступа и удаленной аутентификации BIG-IP (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO), серверного программного обеспечения BIG-IQ Centralized Management связана с недостаточной проверкой аргументов, передаваемых в команду. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные команды в целевой системе

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.

Learn more about Scaner-VS 7

Sources

bdu

Related Vulnerabilities

CVE-2021-22986

Reference Links

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22986

https://support.f5.com/csp/article/K03009991

https://www.cybersecurity-help.cz/vdb/SB2021031102

http://packetstormsecurity.com/files/162059/F5-iControl-Server-Side-Request-Forgery-Remote-Command-Execution.html

http://packetstormsecurity.com/files/162066/F5-BIG-IP-16.0.x-Remote-Code-Execution.html

https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv

Recommendations

Source: bdu

Использование рекомендаций:
https://support.f5.com/csp/article/K03009991

URL: https://bdu.fstec.ru/vul/2021-04388

Vulnerable Software (64)

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip access policy manager

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip access policy manager

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip access policy manager

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip access policy manager

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip access policy manager

Operating System: * *

Trait:

{
  "version_end_excluding": "12.1.5.3",
  "version_start_including": "12.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced firewall manager

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced firewall manager

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced firewall manager

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced firewall manager

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced firewall manager

Operating System: * *

Trait:

{
  "version_end_excluding": "12.1.5.3",
  "version_start_including": "12.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced web application firewall

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced web application firewall

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced web application firewall

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip advanced web application firewall

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application acceleration manager

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application acceleration manager

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application acceleration manager

Operating System: * *

Trait:

{
  "version_end_excluding": "12.1.5.3",
  "version_start_including": "12.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application acceleration manager

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application acceleration manager

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application security manager

Operating System: * *

Trait:

{
  "version_end_excluding": "12.1.5.3",
  "version_start_including": "12.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application security manager

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application security manager

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip application security manager

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip ddos hybrid defender

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip ddos hybrid defender

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip ddos hybrid defender

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip global traffic manager

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip global traffic manager

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip global traffic manager

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip global traffic manager

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip global traffic manager

Operating System: * *

Trait:

{
  "version_end_excluding": "12.1.5.3",
  "version_start_including": "12.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip policy enforcement manager

Operating System: * *

Trait:

{
  "version_end_excluding": "15.1.2.1",
  "version_start_including": "15.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip policy enforcement manager

Operating System: * *

Trait:

{
  "version_end_excluding": "16.0.1.1",
  "version_start_including": "16.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip policy enforcement manager

Operating System: * *

Trait:

{
  "version_end_excluding": "12.1.5.3",
  "version_start_including": "12.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip policy enforcement manager

Operating System: * *

Trait:

{
  "version_end_excluding": "13.1.3.6",
  "version_start_including": "13.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-ip policy enforcement manager

Operating System: * *

Trait:

{
  "version_end_excluding": "14.1.4",
  "version_start_including": "14.1.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-iq centralized management

Operating System: * *

Trait:

{
  "version_end_excluding": "7.0.0.2",
  "version_start_including": "7.0.0"
}

Source: bdu

Type: Configuration

Vendor: f5 networks, inc.

Product: big-iq centralized management

Operating System: * *

Trait:

{
  "version_end_excluding": "7.1.0.3",
  "version_start_including": "7.1.0"
}

Source: bdu

Russian Vulnerability Scanner Database

BDU:2021-04388

Scores

EPSS

CVSS

All CVSS Scores

Vector Breakdown

CVSS

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality Impact

Integrity Impact

Availability Impact

Vector Breakdown

CVSS

Attack Vector

Attack Complexity

Authentication

Confidentiality Impact

Integrity Impact

Availability Impact

Description

Scaner-VS 7 — a modern vulnerability management solution

Sources

Related Vulnerabilities

Reference Links

Recommendations

Vulnerable Software (64)