CVE-2021-23050

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-14 · updated 2026-06-17
Weakness: CWE-352

Description

On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3.5.0, when a cross-site request forgery (CSRF)-enabled policy is configured on a virtual server, an undisclosed HTML response may cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 Big-Ip Advanced Web Application Firewall: from 15.1.0 before 15.1.3.1; from 16.0.0 before 16.0.1.2 — fixed in 15.1.3.1, 16.0.1.2
BIG-IP ASM: from 15.1.0 before 15.1.3.1; from 16.0.0 before 16.0.1.2 — fixed in 15.1.3.1, 16.0.1.2
F5 Nginx App Protect: from 1.0.0 through 1.3.0; from 2.0.0 through 2.3.0; from 3.0.0 before 3.5.0 — fixed in 3.5.0

How to fix

Upgrade to a fixed version: F5 Big-Ip Advanced Web Application Firewall 15.1.3.1, 16.0.1.2; BIG-IP ASM 15.1.3.1, 16.0.1.2; F5 Nginx App Protect 3.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23050 or the next vulnerability affects your stack