K000133041 : ModSecurity vulnerability CVE-2023-24021

2023-03-1700:00:00

my.f5.com

modsecurity

cve-2023-24021

file uploads

waf bypasses

buffer over-reads

f5 products

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

61.0%

JSON

Security Advisory Description

Incorrect handling of ‘\0’ bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection. (CVE-2023-24021)

Impact

There is no impact; F5 products are not affected by this vulnerability.

CPENameOperatorVersion
f5 ssl orchestratoreq14.1.0
f5 ssl orchestratoreq14.1.2
f5 ssl orchestratoreq14.1.4
f5 ssl orchestratoreq15.1.0
f5 ssl orchestratoreq15.1.1
f5 ssl orchestratoreq16.1.0
f5 ssl orchestratoreq16.1.1
f5 ssl orchestratoreq16.1.2
f5 ssl orchestratoreq16.1.3
f5 ssl orchestratoreq17.0.0

Name	Operator	Version
f5 ssl orchestrator	eq	14.1.0
f5 ssl orchestrator	eq	14.1.2
f5 ssl orchestrator	eq	14.1.4
f5 ssl orchestrator	eq	15.1.0
f5 ssl orchestrator	eq	15.1.1
f5 ssl orchestrator	eq	16.1.0
f5 ssl orchestrator	eq	16.1.1
f5 ssl orchestrator	eq	16.1.2
f5 ssl orchestrator	eq	16.1.3
f5 ssl orchestrator	eq	17.0.0