Medium severity · published Mar 31, 2021
CVE-2021-23002
When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions…
4.5
CVSS
0.4%
EPSS
No
On KEV
Description
When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Access Policy Manager Clients · F5
7.1.5 before 7.1.8.5; 7.1.9 before 7.1.9.8; 7.2.1 before 7.2.1.1 · source: NVD
BA
Big-ip Access Policy Manager · F5
11.6.1 through 11.6.5; 12.1.0 through 12.1.5; 13.1.0 before 13.1.3.6; 14.1.0 before 14.1.4; 15.1.0 before 15.1.2.1; 16.0.0 before 16.0.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23002
Vendor Advisory
https://support.f5.com/csp/article/K71891773
More from Access Policy Manager Clients
7.8
CVE-2023-38418
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End…
7.8
CVE-2022-29263
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of…
7.8
CVE-2021-22980
In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client…
5.5
CVE-2023-36858
An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list. Note:…