PT-2014-8945 · F5 · Application Security Manager+1

Publicado 2014-12-08 · Atualizado 2021-05-03 · CVE-2014-9342

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP version 11.3.0

Description A cross-site scripting (XSS) issue exists in the tree view feature of Application Security Manager (ASM) due to insufficient validation of user input. This allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation.

Recommendations For F5 BIG-IP version 11.3.0, consider restricting access to the tree view feature in ASM until a fix is available. As a temporary workaround, avoid using the crafted URLs that could trigger automatic policy generation with malicious input.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9342

Produtos afetados

Application Security Manager

F5 Big-Ip

Referências · 6

• http://secunia.com/advisories/62000 · Nota
• https://support.f5.com/kb/en-us/solutions/public/15000/900/sol15939.html · Nota
• https://support.f5.com/csp/article/K15939 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9342 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9342 · Nota de Segurança
• http://securityfocus.com/archive/1/534137/100/0/threaded · Nota