CVSS: 8.2EPSS: 0%CPEs: 56EXPL: 0CVE-2021-23012
https://notcve.org/view.php?id=CVE-2021-23012
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash commands on BIG-IP. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3, 14.1.x anteriores a 14.1.4 y versiones 13.1.x anteriores a 13.1.4, falta de validación de entrada para los elementos utilizados en la funcionalidad de soporte del sistema puede permitir que los usuarios a los que se les otorguen roles de "Resource Administrator" o "Administrator" ejecutar comandos bash arbitrarios en BIG-IP. Nota: No se evalúan las versiones de software que hayan alcanzado el End of Technical Support (EoTS) • https://support.f5.com/csp/article/K04234247 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 70EXPL: 0CVE-2021-23013
https://notcve.org/view.php?id=CVE-2021-23013
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, the Traffic Management Microkernel (TMM) may stop responding when processing Stream Control Transmission Protocol (SCTP) traffic under certain conditions. This vulnerability affects TMM by way of a virtual server configured with an SCTP profile. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4, versiones 13.1.x anteriores a 13.1.3.6 y versiones 12.1.x anteriores a 12.1.5.3, el Traffic Management Microkernel (TMM), puede dejar de responder al procesar el tráfico Stream Control Transmission Protocol (SCTP) bajo determinadas condiciones. Esta vulnerabilidad afecta a TMM por medio de un servidor virtual configurado con un perfil SCTP. • https://support.f5.com/csp/article/K04234247 https://support.f5.com/csp/article/K05300051 •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23011
https://notcve.org/view.php?id=CVE-2021-23011
On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x before 11.6.5.3, when the BIG-IP system is buffering packet fragments for reassembly, the Traffic Management Microkernel (TMM) may consume an excessive amount of resources, eventually leading to a restart and failover event. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.3, versiones 14.1.x anteriores a 14.1.4, versiones 13.1.x anteriores a 13.1.4, versiones 12.1.x anteriores a 12.1.6 y versiones 11.6.x anteriores a 11.6.5.3, cuando el sistema BIG-IP está almacenando fragmentos de paquetes en búfer para volver a ensamblarlos, el Traffic Management Microkernel (TMM) puede consumir una cantidad excesiva de recursos, conllevando eventualmente a un evento de reinicio y conmutación por error. Nota: Las versiones de Software que hayan alcanzado End of Technical Support (EoTS) no son evaluadas • https://support.f5.com/csp/article/K10751325 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23004
https://notcve.org/view.php?id=CVE-2021-23004
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, Multipath TCP (MPTCP) forwarding flows may be created on standard virtual servers without MPTCP enabled in the applied TCP profile. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En BIG-IP versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2, versiones 14.1.x anteriores a 14.1.3.1, versiones 13.1.x anteriores a 13.1.3.6, versiones 12.1.x anteriores a 12.1.5.3 y versiones 11.6.x anteriores a 11.6.5.3, Los flujos de reenvío de Multipath TCP (MPTCP) se pueden crear en servidores virtuales estándar sin MPTCP habilitado en el perfil de TCP aplicado. Nota: No se evalúan las versiones de software que han alcanzado End of Software Development (EoSD). • https://support.f5.com/csp/article/K31025212 •
CVSS: 4.3EPSS: 0%CPEs: 84EXPL: 0CVE-2021-23001
https://notcve.org/view.php?id=CVE-2021-23001
On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, the upload functionality in BIG-IP Advanced WAF and BIG-IP ASM allows an authenticated user to upload files to the BIG-IP system using a call to an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. En las versiones 16.0.x anteriores a 16.0.1.1, versiones 15.1.x anteriores a 15.1.2.1, versiones 14.1.x anteriores a 14.1.4, versiones 13.1.x anteriores a 13.1.3.6, versiones 12.1.x anteriores a 12.1.5.3 y versiones 11.6.x anteriores a 11.6.5.3 , la funcionalidad de carga en BIG-IP Advanced WAF y BIG-IP ASM permite a un usuario autenticado cargar archivos al sistema BIG-IP mediante una llamada a un endpoint iControl REST no revelado. Nota: No se evalúan las versiones de software que han alcanzado End of Software Development (EoSD). • https://support.f5.com/csp/article/K06440657 • CWE-434: Unrestricted Upload of File with Dangerous Type •