CVE-2021-23002 Information disclosure in BIG-IP APM and Edge Client
Attackers can view session IDs in command-line arguments when launching the VPN client from a browser, potentially leading to session hijacking.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23002?
CVE-2021-23002 is a medium-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 31 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When using BIG-IP APM 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, or all 12.1.x and 11.6.x versions or Edge Client versions 7.2.1.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, or 7.1.8.x before 7.1.8.5, the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. Addressing this issue requires both the client and server fixes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Which versions are affected by CVE-2021-23002?
It affects 2 products.
Products include F5 Access Policy Manager Clients, F5 Big-Ip Access Policy Manager.
How do I fix CVE-2021-23002?
No fix has been published for CVE-2021-23002 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-23002 being exploited?
There is no known exploitation of CVE-2021-23002 in the wild and no public exploit code.
Other vulnerabilities in F5 Big-Ip Access Policy Manager
Sources
Also known as GHSA-4vpw-2c2c-m7m5.