CVE-2021-23043 Path traversal in BIG-IP

Medium 6.5 Published 14 Sep 2021 Updated 3 Aug 2024

An attacker can access arbitrary files on BIG-IP devices via a directory traversal vulnerability in the Configuration utility.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-23043?

CVE-2021-23043 is a medium-severity path traversal vulnerability in F5 Big-Ip Access Policy Manager, published on 14 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to access arbitrary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness: CWE-22

Which versions are affected by CVE-2021-23043?

It affects 11 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 5 more.

How do I fix CVE-2021-23043?

No fix has been published for CVE-2021-23043 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-23043 being exploited?

There is no known exploitation of CVE-2021-23043 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-9f5g-mr9p-4fxc.