#VU51601 Information disclosure in BIG-IP APM and APM Clients - CVE-2021-23002

Vulnerability identifier: #VU51601

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-23002

CWE-ID: CWE-200

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
BIG-IP APM
Hardware solutions / Security hardware applicances
APM Clients
Hardware solutions / Security hardware applicances

Vendor: F5 Networks

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the session ID is visible in the arguments of the f5vpn.exe command when VPN is launched from the browser on a Windows system. A remote administrator on the local network can view the session ID.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

BIG-IP APM: 11.6.1 HF1 - 16.0.1

APM Clients: 7.1.5 - 7.2.1

---

External links
https://support.f5.com/csp/article/K71891773

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.