Cross site scripting

2019-03-1322:29:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.9%

JSON

In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the “guest” role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.

CPENameOperatorVersion
big-ip_access_policy_managerge14.0.0
big-ip_access_policy_managerle14.0.0.2
big-ip_access_policy_managerge12.1.0
big-ip_access_policy_managerle12.1.3.7
big-ip_access_policy_managerge13.0.0
big-ip_access_policy_managerle13.1.1.3
big-ip_access_policy_managerge11.5.1
big-ip_access_policy_managerle11.5.8
big-ip_access_policy_managerge11.6.1
big-ip_access_policy_managerle11.6.3.2

Name	Operator	Version
big-ip_access_policy_manager	ge	14.0.0
big-ip_access_policy_manager	le	14.0.0.2
big-ip_access_policy_manager	ge	12.1.0
big-ip_access_policy_manager	le	12.1.3.7
big-ip_access_policy_manager	ge	13.0.0
big-ip_access_policy_manager	le	13.1.1.3
big-ip_access_policy_manager	ge	11.5.1
big-ip_access_policy_manager	le	11.5.8
big-ip_access_policy_manager	ge	11.6.1
big-ip_access_policy_manager	le	11.6.3.2