Details of VAR-202109-0774

ID

VAR-202109-0774

CVE

CVE-2021-23053

TITLE

BIG-IP Advanced WAF and BIG-IP ASM Resource exhaustion vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-012089

DESCRIPTION

On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to lack of row limit on undisclosed tables in the MYSQL database. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. BIG-IP Advanced WAF and BIG-IP ASM Exists in a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. A security vulnerability exists in the F5 BIG-IP. The vulnerability stems from the fact that attackers can use the Brute Force of F5 BIG-IP WAF/ASM to fill the database and cause fatal errors to trigger denial of service

Trust: 1.8

sources: NVD: CVE-2021-23053 // JVNDB: JVNDB-2021-012089 // VULHUB: VHN-381539 // VULMON: CVE-2021-23053

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip advanced web application firewall	scope:	lt	version:	14.1.3.1	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	gte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	13.1.3.6	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	gte	version:	14.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	gte	version:	14.1.0	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	14.1.3.1	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	lt	version:	13.1.3.6	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	gte	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	gte	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced web application firewall	scope:	lt	version:	15.1.3	Trust: 1.0
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	15.1.x	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	14.1.x	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	14.1.3.1	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	lt	version:	13.1.x	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	15.1.3	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	13.1.3.6	Trust: 0.8
vendor:	f5	model:	big-ip advanced web application firewall	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-012089 // NVD: CVE-2021-23053

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-23053
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-23053
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202108-2054
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-381539
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2021-23053
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-23053
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-381539
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-23053
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2021-23053
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-381539 // VULMON: CVE-2021-23053 // JVNDB: JVNDB-2021-012089 // CNNVD: CNNVD-202108-2054 // NVD: CVE-2021-23053

PROBLEMTYPE DATA

problemtype:	CWE-770	Trust: 1.1
problemtype:	CWE-400	Trust: 1.0
problemtype:	Resource exhaustion (CWE-400) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-381539 // JVNDB: JVNDB-2021-012089 // NVD: CVE-2021-23053

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-2054

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202108-2054

PATCH

title:	K36942191	url:	https://support.f5.com/csp/article/K36942191	Trust: 0.8
title:	F5 BIG-IP Remediation of resource management error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=163945	Trust: 0.6
title:	-	url:	https://github.com/Live-Hack-CVE/CVE-2021-23053	Trust: 0.1

sources: VULMON: CVE-2021-23053 // JVNDB: JVNDB-2021-012089 // CNNVD: CNNVD-202108-2054

EXTERNAL IDS

db:	NVD	id:	CVE-2021-23053	Trust: 3.4
db:	JVNDB	id:	JVNDB-2021-012089	Trust: 0.8
db:	CNNVD	id:	CNNVD-202108-2054	Trust: 0.7
db:	AUSCERT	id:	ESB-2021.2862	Trust: 0.6
db:	VULHUB	id:	VHN-381539	Trust: 0.1
db:	VULMON	id:	CVE-2021-23053	Trust: 0.1

sources: VULHUB: VHN-381539 // VULMON: CVE-2021-23053 // JVNDB: JVNDB-2021-012089 // CNNVD: CNNVD-202108-2054 // NVD: CVE-2021-23053

REFERENCES

url:	https://support.f5.com/csp/article/k36942191	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2021-23053	Trust: 1.4
url:	https://www.auscert.org.au/bulletins/esb-2021.2862	Trust: 0.6
url:	https://vigilance.fr/vulnerability/f5-big-ip-waf-asm-denial-of-service-via-brute-force-fill-database-36183	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/770.html	Trust: 0.1
url:	https://github.com/live-hack-cve/cve-2021-23053	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-381539 // VULMON: CVE-2021-23053 // JVNDB: JVNDB-2021-012089 // CNNVD: CNNVD-202108-2054 // NVD: CVE-2021-23053

SOURCES

db:	VULHUB	id:	VHN-381539
db:	VULMON	id:	CVE-2021-23053
db:	JVNDB	id:	JVNDB-2021-012089
db:	CNNVD	id:	CNNVD-202108-2054
db:	NVD	id:	CVE-2021-23053

LAST UPDATE DATE

2024-08-14T14:31:38.042000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-381539	date:	2022-08-30T00:00:00
db:	VULMON	id:	CVE-2021-23053	date:	2022-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2021-012089	date:	2022-08-23T09:12:00
db:	CNNVD	id:	CNNVD-202108-2054	date:	2022-08-31T00:00:00
db:	NVD	id:	CVE-2021-23053	date:	2022-08-30T16:13:20.887

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-381539	date:	2021-09-14T00:00:00
db:	VULMON	id:	CVE-2021-23053	date:	2021-09-14T00:00:00
db:	JVNDB	id:	JVNDB-2021-012089	date:	2022-08-23T00:00:00
db:	CNNVD	id:	CNNVD-202108-2054	date:	2021-08-24T00:00:00
db:	NVD	id:	CVE-2021-23053	date:	2021-09-14T13:15:11.403