PT-2008-1909 · F5 · F5 Big-Ip

Nnposter · Publicado 2008-01-15 · Atualizado 2018-10-30 · CVE-2008-0265

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP version 9.4.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Search function of the web management interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to various API endpoints, including "/tmui/Control/jspmap/tmui/system/log/" with files such as "list system.jsp", "list pktfilter.jsp", "list ltm.jsp", "resources audit.jsp", and "list asm.jsp", as well as "list.jsp" in certain directories.

Recommendations For F5 BIG-IP version 9.4.3, as a temporary workaround, consider restricting access to the Search function in the web management interface until a patch is available. Avoid using the SearchString parameter in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0265

Produtos afetados

F5 Big-Ip

Referências · 9

• 🔥 https://exploit-db.com/exploits/31024 · Exploit
• http://secunia.com/advisories/28505 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/0181 · Nota
• http://securitytracker.com/id?1019190 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0265 · Nota de Segurança
• http://securityfocus.com/bid/27272 · Nota
• http://securityfocus.com/archive/1/486217/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39632 · Nota
• http://securityreason.com/securityalert/3545 · Nota