{"containers": {"cna": {"affected": [{"product": "Edge Client", "vendor": "n/a", "versions": [{"status": "affected", "version": "7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5"}]}], "descriptions": [{"lang": "en", "value": "In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated."}], "problemTypes": [{"descriptions": [{"description": "Code injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-12T17:52:28", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.f5.com/csp/article/K29282483"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "f5sirt@f5.com", "ID": "CVE-2021-22980", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Edge Client", "version": {"version_data": [{"version_value": "7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Code injection"}]}]}, "references": {"reference_data": [{"name": "https://support.f5.com/csp/article/K29282483", "refsource": "MISC", "url": "https://support.f5.com/csp/article/K29282483"}]}}}}, "cveMetadata": {"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2021-22980", "datePublished": "2021-02-12T17:52:28", "dateReserved": "2021-01-06T00:00:00", "dateUpdated": "2021-02-12T17:52:28", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*", "matchCriteriaId": "8BBCE39D-283C-4D80-A83D-D4C94F2C4D92", "versionEndExcluding": "7.1.8.5", "versionStartIncluding": "7.1.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*", "matchCriteriaId": "6CB004A6-19ED-43E4-BE0B-76A742120B7D", "versionEndExcluding": "7.1.9.8", "versionStartIncluding": "7.1.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:access_policy_manager_clients:*:*:*:*:*:*:*:*", "matchCriteriaId": "B60E89ED-5C0A-4B21-A5C5-2F902E4A2891", "versionEndExcluding": "7.2.1.1", "versionStartIncluding": "7.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FBA9552-4645-4BFF-91A4-47B6A3414325", "versionEndIncluding": "11.6.5", "versionStartIncluding": "11.6.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C3B5688-0235-4D4F-A26C-440FF24A1B43", "versionEndIncluding": "12.1.5", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C3A0A32-E425-4939-A30D-95A046ABBABB", "versionEndExcluding": "13.1.3.6", "versionStartIncluding": "13.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "B176513C-86DD-4DA9-AB60-1D233091A9DB", "versionEndIncluding": "14.1.3", "versionStartIncluding": "14.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "5EF8BF70-3688-4DEE-BF08-835293783996", "versionEndIncluding": "15.1.2", "versionStartIncluding": "15.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7706F70-BF89-480E-9AA6-3FE447375138", "versionEndExcluding": "16.0.1.1", "versionStartIncluding": "16.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated."}, {"lang": "es", "value": "En Edge Client versiones 7.2.x anteriores a 7.2.1.1, versiones 7.1.9.x anteriores 7.1.9.8 y versiones 7.1.x-7.1.8.x anteriores a 7.1.8.5, una vulnerabilidad de ruta de b\u00fasqueda no confiable en BIG-IP APM Client Troubleshooting Utility (CTU) para Windows, podr\u00eda permitir a un atacante cargar una biblioteca DLL maliciosa desde su directorio actual. Es requerida una interacci\u00f3n del usuario para explotar esta vulnerabilidad, ya que la v\u00edctima debe ejecutar esta utilidad en el sistema Windows. Nota: No son evaluadas las versiones de software que han alcanzado End of Software Development (EoSD)"}], "id": "CVE-2021-22980", "lastModified": "2021-02-19T17:57:27.057", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-12T18:15:12.737", "references": [{"source": "f5sirt@f5.com", "tags": ["Vendor Advisory"], "url": "https://support.f5.com/csp/article/K29282483"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}