Vulnerability Description
BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | >= 15.1.0, < 15.1.9 |
| F5 | Big-Iq Centralized Management | >= 8.0.0, <= 8.3.0 |
| F5 | Big-Ip Advanced Firewall Manager | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Analytics | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Application Acceleration Manager | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Application Security Manager | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Domain Name System | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Fraud Protection Service | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Global Traffic Manager | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Link Controller | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Local Traffic Manager | >= 15.1.0, < 15.1.9 |
| F5 | Big-Ip Policy Enforcement Manager | >= 15.1.0, < 15.1.9 |
Related Weaknesses (CWE)
References
- https://my.f5.com/manage/s/article/K98606833Vendor Advisory
- https://my.f5.com/manage/s/article/K98606833Vendor Advisory
FAQ
What is CVE-2024-21782?
CVE-2024-21782 is a vulnerability with a CVSS score of 6.7 (MEDIUM). BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to Advanced shell (bash) can execute arbitrary commands with a...
How severe is CVE-2024-21782?
CVE-2024-21782 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-21782?
Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Iq Centralized Management, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager.