PT-2014-8945 · F5 · Application Security Manager+1

Published 2014-12-08 · Updated 2021-05-03 · CVE-2014-9342

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP version 11.3.0

Description A cross-site scripting (XSS) issue exists in the tree view feature of Application Security Manager (ASM) due to insufficient validation of user input. This allows remote attackers to inject arbitrary web script or HTML by accessing a crafted URL during automatic policy generation.

Recommendations For F5 BIG-IP version 11.3.0, consider restricting access to the tree view feature in ASM until a fix is available. As a temporary workaround, avoid using the crafted URLs that could trigger automatic policy generation with malicious input.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9342

Affected Products

Application Security Manager

F5 Big-Ip

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-9342 · Security Note
• http://secunia.com/advisories/62000 · Note
• https://support.f5.com/kb/en-us/solutions/public/15000/900/sol15939.html · Note
• https://support.f5.com/csp/article/K15939 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9342 · Note
• http://securityfocus.com/archive/1/534137/100/0/threaded · Note