Design/Logic Flaw

2020-04-3021:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.5%

JSON

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.

CPENameOperatorVersion
big-ip_access_policy_managerge15.0.0
big-ip_access_policy_managerle15.0.1.2
big-ip_access_policy_managerge15.1.0
big-ip_access_policy_managerle15.1.0.1
big-ip_access_policy_managerge14.1.0
big-ip_access_policy_managerle14.1.2.3

Name	Operator	Version
big-ip_access_policy_manager	ge	15.0.0
big-ip_access_policy_manager	le	15.0.1.2
big-ip_access_policy_manager	ge	15.1.0
big-ip_access_policy_manager	le	15.1.0.1
big-ip_access_policy_manager	ge	14.1.0
big-ip_access_policy_manager	le	14.1.2.3

References

support.f5.com/csp/article/K24415506