F5 Networks ASM appliance contains a cross-site scripting vulnerability

Overview

F5 Networks ASM appliance versions 10.0.0 through 11.2.0 HF2 are susceptible to a cross-site scripting vulnerability in the traffic overview page.

Description

A cross-site scripting (XSS) (CWE-79) vulnerability exists in the traffic overview page. By sending several malicious requests, an attacker may be able to have the requests propagate to the summary listings page where proper sanitization is not performed.

---

Impact

An attacker may be able to execute arbitrary script in the context of an authenticated user’s session.

---

Solution

Apply an Update

Vendor patches (Portal authentication required) are available for supported versions.

---

Vendor Information

143395

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

F5 Networks, Inc. __ Affected

Notified: July 12, 2012 Updated: September 10, 2012

Status

Affected

Vendor Statement

F5 considers this issue to be serious as repeated unauthenticated malicious requests will propagate to a “Top Ten” list on the summary page unsanitized. An authenticated user viewing the overview page could then execute the request leading to compromise.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://support.f5.com/kb/en-us/solutions/public/13000/800/sol13838.html&gt;

CVSS Metrics

Group	Score	Vector
Base	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N
Temporal	3.4	E:POC/RL:OF/RC:C
Environmental	3.4	CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

• <http://www.f5.com/products/big-ip/big-ip-application-security-manager/overview&gt;
• <https://support.f5.com/kb/en-us/solutions/public/13000/800/sol13838.html&gt;
• <http://cwe.mitre.org/data/definitions/79.html&gt;

Acknowledgements

Thanks to F5 Networks for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2012-2975
Date Public:	2012-09-10 Date First Published: