PT-2008-1909 · F5 · F5 Big-Ip

Nnposter · Published 2008-01-15 · Updated 2018-10-30 · CVE-2008-0265

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP version 9.4.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Search function of the web management interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the SearchString parameter to various API endpoints, including "/tmui/Control/jspmap/tmui/system/log/" with files such as "list system.jsp", "list pktfilter.jsp", "list ltm.jsp", "resources audit.jsp", and "list asm.jsp", as well as "list.jsp" in certain directories.

Recommendations For F5 BIG-IP version 9.4.3, as a temporary workaround, consider restricting access to the Search function in the web management interface until a patch is available. Avoid using the SearchString parameter in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0265

Affected Products

F5 Big-Ip

References · 9

• 🔥 https://exploit-db.com/exploits/31024 · Exploit
• http://secunia.com/advisories/28505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0265 · Security Note
• http://vupen.com/english/advisories/2008/0181 · Note
• http://securitytracker.com/id?1019190 · Note
• http://securityfocus.com/bid/27272 · Note
• http://securityfocus.com/archive/1/486217/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39632 · Note
• http://securityreason.com/securityalert/3545 · Note