Details of VAR-202106-1417

ID

VAR-202106-1417

CVE

CVE-2021-23022

TITLE

F5 BIG-IP Edge Gateway Security hole

Trust: 0.6

sources: CNNVD: CNNVD-202106-127

DESCRIPTION

On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has weak file and folder permissions. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. F5 BIG-IP Edge Gateway is a set of remote access solutions of F5 Company in the United States. A security vulnerability exists in BIG-IP Edge Client that could allow an unprivileged user to run a specially crafted application to gain privilege escalation on the client Windows system

Trust: 0.99

sources: NVD: CVE-2021-23022 // VULHUB: VHN-381508

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	12.1.6	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager client	scope:	gte	version:	7.1.6	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	11.6.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager client	scope:	lte	version:	7.1.9.9	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager client	scope:	gte	version:	7.2.1	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager client	scope:	lt	version:	7.2.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	11.6.5	Trust: 1.0

sources: NVD: CVE-2021-23022

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-23022
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202106-127
value:	HIGH
Trust: 0.6
VULHUB:	VHN-381508
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-23022
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-381508
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-23022
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: VULHUB: VHN-381508 // CNNVD: CNNVD-202106-127 // NVD: CVE-2021-23022

PROBLEMTYPE DATA

problemtype:

CWE-732

Trust: 1.1

sources: VULHUB: VHN-381508 // NVD: CVE-2021-23022

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202106-127

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202106-127

PATCH

title:

F5 BIG-IP Security vulnerabilities

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=154700

Trust: 0.6

sources: CNNVD: CNNVD-202106-127

EXTERNAL IDS

db:	NVD	id:	CVE-2021-23022	Trust: 1.7
db:	AUSCERT	id:	ESB-2021.1883	Trust: 0.6
db:	CNNVD	id:	CNNVD-202106-127	Trust: 0.6
db:	VULHUB	id:	VHN-381508	Trust: 0.1

sources: VULHUB: VHN-381508 // CNNVD: CNNVD-202106-127 // NVD: CVE-2021-23022

REFERENCES

url:	https://support.f5.com/csp/article/k08503505	Trust: 1.7
url:	https://vigilance.fr/vulnerability/f5-big-ip-edge-client-for-windows-privilege-escalation-via-installer-service-temporary-folder-35588	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2021.1883	Trust: 0.6

sources: VULHUB: VHN-381508 // CNNVD: CNNVD-202106-127 // NVD: CVE-2021-23022

SOURCES

db:	VULHUB	id:	VHN-381508
db:	CNNVD	id:	CNNVD-202106-127
db:	NVD	id:	CVE-2021-23022

LAST UPDATE DATE

2024-08-14T14:31:42.550000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-381508	date:	2021-06-23T00:00:00
db:	CNNVD	id:	CNNVD-202106-127	date:	2021-08-16T00:00:00
db:	NVD	id:	CVE-2021-23022	date:	2021-06-23T15:22:46.847

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-381508	date:	2021-06-10T00:00:00
db:	CNNVD	id:	CNNVD-202106-127	date:	2021-06-02T00:00:00
db:	NVD	id:	CVE-2021-23022	date:	2021-06-10T16:15:08.033