PT-2017-9194 · F5 · F5 Big-Ip

Publicado 2017-06-09 · Atualizado 2019-06-06 · CVE-2016-7469

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.2.1, 11.4.0 through 11.6.1, 12.0.0 through 12.1.2

Description A stored cross-site scripting (XSS) issue exists in the Configuration utility device name change page. This allows an authenticated user with Resource Administrator or Administrator privileges to inject arbitrary web script or HTML, potentially causing the Configuration utility client to become unstable.

Recommendations For versions 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, consider restricting access to the Configuration utility device name change page until a fix is available. As a temporary workaround, limit the privileges of users to prevent exploitation, ensuring only necessary personnel have Resource Administrator or Administrator privileges. Avoid using the Configuration utility device name change page with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-7469

Produtos afetados

F5 Big-Ip

Referências · 6

• https://osv.dev/vulnerability/CVE-2016-7469 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7469 · Nota de Segurança
• http://securitytracker.com/id/1037559 · Nota
• http://securitytracker.com/id/1037560 · Nota
• http://securityfocus.com/bid/95320 · Nota
• https://support.f5.com/csp/article/K97285349 · Aviso do Fabricante