CVE-2021-22984 Open redirect in BIG-IP Advanced WAF & BIG-IP ASM

Medium 6.1 Published 12 Feb 2021 Updated 3 Aug 2024

Attackers can exploit malicious URIs in BIG-IP WAF/ASM to perform open redirection attacks, potentially bypassing security controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-22984?

CVE-2021-22984 is a medium-severity vulnerability in F5 Big-Ip Advanced Web Application Firewall, published on 12 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Weakness: CWE-601

Which versions are affected by CVE-2021-22984?

It affects 2 products.

Products include F5 Big-Ip Advanced Web Application Firewall, F5 Big-Ip Application Security Manager.

How do I fix CVE-2021-22984?

No fix has been published for CVE-2021-22984 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22984 being exploited?

There is no known exploitation of CVE-2021-22984 in the wild and no public exploit code.

All F5 Big-Ip Advanced Web Application Firewall vulnerabilities

Sources

Also known as GHSA-jjvj-f9jx-5jv4.