CVE-2021-23040 SQL injection in BIG-IP AFM
SQL injection in BIG-IP AFM Configuration utility allows attackers to read or modify data when AFM is provisioned.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-23040?
CVE-2021-23040 is a high-severity SQL injection vulnerability in F5 Big-Ip Advanced Firewall Manager, published on 14 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility. This issue is exposed only when BIG-IP AFM is provisioned. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-89
Which versions are affected by CVE-2021-23040?
It affects 1 product.
Products include F5 Big-Ip Advanced Firewall Manager.
How do I fix CVE-2021-23040?
No fix has been published for CVE-2021-23040 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-23040 being exploited?
There is no known exploitation of CVE-2021-23040 in the wild and no public exploit code.
Other vulnerabilities in F5 Big-Ip Advanced Firewall Manager
Sources
Also known as GHSA-3622-x4mv-fpmp.