PT-2008-1665 · F5 · F5 Firepass 4100 Ssl Vpn

Adrian Pastor

+1

·

Published

2008-03-05

·

Updated

2018-10-15

·

CVE-2007-6704

CVSS v2.0

2.6

Low

VectorAV:N/AC:H/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2 F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1
Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the query string to specific API endpoints, such as "my.activation.php3" and "my.logon.php3", when pre-logon sequences are enabled.
Recommendations For F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2, update to a version outside of this range to resolve the issue. For F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the "my.activation.php3" and "my.logon.php3" endpoints until a patch is available.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-6704

Affected Products

F5 Firepass 4100 Ssl Vpn