PT-2008-1665 · F5 · F5 Firepass 4100 Ssl Vpn

Adrian Pastor

+1

·

Publicado

2008-03-05

·

Atualizado

2018-10-15

·

CVE-2007-6704

CVSS v2.0

2.6

Baixa

VetorAV:N/AC:H/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2 F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1
Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the query string to specific API endpoints, such as "my.activation.php3" and "my.logon.php3", when pre-logon sequences are enabled.
Recommendations For F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2, update to a version outside of this range to resolve the issue. For F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the "my.activation.php3" and "my.logon.php3" endpoints until a patch is available.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-6704

Produtos afetados

F5 Firepass 4100 Ssl Vpn