Description
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SEC Consult Vulnerability Lab Security Advisory < 20140828-0 >
=======================================================================
title: Reflected Cross-Site Scripting
product: F5 BIG-IP
vulnerable version: <= 11.5.1
fixed version: > 11.6.0
impact: Medium
CVE number: CVE-2014-4023
homepage: https://f5.com/
found: 2014-07-07
by: Stefan Viehbock
SEC Consult Vulnerability Lab
https://www.sec-consult.com
=======================================================================
Vendor/product description:
- -----------------------------
"The BIG-IP product suite is a system of application delivery services that
work together on the same best-in-class hardware platform or software virtual
instance. From load balancing and service offloading to acceleration and
security, the BIG-IP system delivers agility—and ensures your applications
are fast, secure, and available."
URL: https://f5.com/products/big-ip
Vulnerability overview/description:
- -----------------------------------
BIG-IP suffers from a reflected Cross-Site Scripting vulnerability,
which allow an attacker to steal other users sessions, to impersonate other
users and to gain unauthorized access to the admin interface.
Proof of concept:
- -----------------
The following HTTP request triggers the vulnerability:
POST /tmui/dashboard/echo.jsp HTTP/1.1
Host: BIGIP
Cookie: BIGIPAuthCookie=*VALID_COOKIE*
Content-Length: 29
<script>alert('xss')</script>
The server does not properly encode user supplied information and returns it
to the user resulting in Cross-Site Scripting.
Vulnerable / tested versions:
- -----------------------------
More information can be found at:
https://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html
Vendor contact timeline:
- ------------------------
2014-07-08: Sending advisory and proof of concept exploit via encrypted
channel.
2014-07-09: Vendor confirms receipt of advisory. States that fix will be
released in the "next 6 weeks or so"
2014-07-24: Vendor provides CVE: CVE-2014-4023
2014-08-26: Vendor releases fixed version.
2014-08-28: SEC Consult releases a coordinated security advisory.
Solution:
- ---------
Update to the newest version.
More information can be found at:
https://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html
Workaround:
- -----------
No workaround available.
Advisory URL:
- -------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius
Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone: +43 1 8903043 0
Fax: +43 1 8903043 15
Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
Interested in working with the experts of SEC Consult?
Write to career@sec-consult.com
EOF Stefan Viehbock / @2014
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBAgAGBQJT/wVOAAoJECyFJyAEdlkKq9cIAKX9MEOpw8p9i8KWZXmkBiBr
S3n9YPNk6bbGbm+YfNCvXvtdSTPhh4I1wBY/WYWENpnQrwdiJ3couS5f2/DQzHTP
uCROxpmtxY1bokMS+ZHOPeGECk8RFr03kBZtGrF2cdGLWzBv7l+CnmopS8lnDVsw
44/R5hj3OdZxhD3btFLXss1RPbUDU1vGV9KpDgJmsssS5pzvG9I2T9xGibd0zBIA
WGA5jjGFitfQwDaxvqoocKgmBG2o3nQpdCShlaRiFklVJQYT1J+w/TWA1OOWZmxs
91m6C9fqAqgeIjmFSOE5c/rpiw7MdzH46yUzoVhbqm6wKcngLDDmZDuqPwaqH18=
=RsbU
-----END PGP SIGNATURE-----
Related
{"id": "SECURITYVULNS:DOC:31069", "bulletinFamily": "software", "title": "SEC Consult SA-20140828-0 :: F5 BIG-IP Reflected Cross-Site Scripting", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\nSEC Consult Vulnerability Lab Security Advisory < 20140828-0 >\r\n=======================================================================\r\n title: Reflected Cross-Site Scripting\r\n product: F5 BIG-IP\r\n vulnerable version: <= 11.5.1\r\n fixed version: > 11.6.0\r\n impact: Medium\r\n CVE number: CVE-2014-4023\r\n homepage: https://f5.com/\r\n found: 2014-07-07\r\n by: Stefan Viehbock\r\n SEC Consult Vulnerability Lab\r\n https://www.sec-consult.com\r\n=======================================================================\r\n\r\nVendor/product description:\r\n- -----------------------------\r\n"The BIG-IP product suite is a system of application delivery services that\r\nwork together on the same best-in-class hardware platform or software virtual\r\ninstance. From load balancing and service offloading to acceleration and\r\nsecurity, the BIG-IP system delivers agility\u2014and ensures your applications\r\nare fast, secure, and available."\r\n\r\nURL: https://f5.com/products/big-ip\r\n\r\n\r\nVulnerability overview/description:\r\n- -----------------------------------\r\nBIG-IP suffers from a reflected Cross-Site Scripting vulnerability,\r\nwhich allow an attacker to steal other users sessions, to impersonate other\r\nusers and to gain unauthorized access to the admin interface.\r\n\r\n\r\nProof of concept:\r\n- -----------------\r\nThe following HTTP request triggers the vulnerability:\r\n\r\nPOST /tmui/dashboard/echo.jsp HTTP/1.1\r\nHost: BIGIP\r\nCookie: BIGIPAuthCookie=*VALID_COOKIE*\r\nContent-Length: 29\r\n\r\n<script>alert('xss')</script>\r\n\r\nThe server does not properly encode user supplied information and returns it\r\nto the user resulting in Cross-Site Scripting.\r\n\r\n\r\nVulnerable / tested versions:\r\n- -----------------------------\r\nMore information can be found at:\r\nhttps://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html\r\n\r\n\r\nVendor contact timeline:\r\n- ------------------------\r\n2014-07-08: Sending advisory and proof of concept exploit via encrypted\r\n channel.\r\n2014-07-09: Vendor confirms receipt of advisory. States that fix will be\r\n released in the "next 6 weeks or so"\r\n2014-07-24: Vendor provides CVE: CVE-2014-4023\r\n2014-08-26: Vendor releases fixed version.\r\n2014-08-28: SEC Consult releases a coordinated security advisory.\r\n\r\n\r\nSolution:\r\n- ---------\r\nUpdate to the newest version.\r\n\r\nMore information can be found at:\r\nhttps://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html\r\n\r\n\r\nWorkaround:\r\n- -----------\r\nNo workaround available.\r\n\r\n\r\nAdvisory URL:\r\n- -------------\r\nhttps://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm\r\n\r\n\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\nSEC Consult Vulnerability Lab\r\n\r\nSEC Consult\r\nVienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius\r\n\r\nHeadquarter:\r\nMooslackengasse 17, 1190 Vienna, Austria\r\nPhone: +43 1 8903043 0\r\nFax: +43 1 8903043 15\r\n\r\nMail: research at sec-consult dot com\r\nWeb: https://www.sec-consult.com\r\nBlog: http://blog.sec-consult.com\r\nTwitter: https://twitter.com/sec_consult\r\n\r\nInterested in working with the experts of SEC Consult?\r\nWrite to career@sec-consult.com\r\n\r\nEOF Stefan Viehbock / @2014\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.9 (MingW32)\r\nComment: Using GnuPG with Thunderbird - http://www.enigmail.net/\r\n\r\niQEcBAEBAgAGBQJT/wVOAAoJECyFJyAEdlkKq9cIAKX9MEOpw8p9i8KWZXmkBiBr\r\nS3n9YPNk6bbGbm+YfNCvXvtdSTPhh4I1wBY/WYWENpnQrwdiJ3couS5f2/DQzHTP\r\nuCROxpmtxY1bokMS+ZHOPeGECk8RFr03kBZtGrF2cdGLWzBv7l+CnmopS8lnDVsw\r\n44/R5hj3OdZxhD3btFLXss1RPbUDU1vGV9KpDgJmsssS5pzvG9I2T9xGibd0zBIA\r\nWGA5jjGFitfQwDaxvqoocKgmBG2o3nQpdCShlaRiFklVJQYT1J+w/TWA1OOWZmxs\r\n91m6C9fqAqgeIjmFSOE5c/rpiw7MdzH46yUzoVhbqm6wKcngLDDmZDuqPwaqH18=\r\n=RsbU\r\n-----END PGP SIGNATURE-----\r\n\r\n", "published": "2014-09-02T00:00:00", "modified": "2014-09-02T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31069", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2014-4023"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:53", "edition": 1, "viewCount": 14, "enchantments": {"score": {"value": 6.3, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-4023"]}, {"type": "f5", "idList": ["F5:K15532", "SOL15532"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/F5-BIG-IP-CVE-2014-4023/"]}, {"type": "nessus", "idList": ["F5_BIGIP_SOL15532.NASL"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:128034"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13949"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2014-4023"]}, {"type": "f5", "idList": ["SOL15532"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/F5-BIG-IP-CVE-2014-4023/"]}, {"type": "nessus", "idList": ["F5_BIGIP_SOL15532.NASL"]}]}, "exploitation": null, "vulnersScore": 6.3}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646217557}}
{"nessus": [{"lastseen": "2021-08-19T12:48:15", "description": "A cross-site scripting (XSS) vulnerability exists intmui/dashboard/echo.jsp for the BIG-IP Configuration utility and the Enterprise Manager Configuration utility.", "cvss3": {"score": null, "vector": null}, "published": "2014-10-10T00:00:00", "type": "nessus", "title": "F5 Networks BIG-IP : XSS vulnerability in echo.jsp (SOL15532)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4023"], "modified": "2021-03-10T00:00:00", "cpe": ["cpe:/a:f5:big-ip_access_policy_manager", "cpe:/a:f5:big-ip_advanced_firewall_manager", "cpe:/a:f5:big-ip_application_acceleration_manager", "cpe:/a:f5:big-ip_application_security_manager", "cpe:/a:f5:big-ip_application_visibility_and_reporting", "cpe:/a:f5:big-ip_global_traffic_manager", "cpe:/a:f5:big-ip_link_controller", "cpe:/a:f5:big-ip_local_traffic_manager", "cpe:/a:f5:big-ip_policy_enforcement_manager", "cpe:/a:f5:big-ip_wan_optimization_manager", "cpe:/a:f5:big-ip_webaccelerator", "cpe:/h:f5:big-ip", "cpe:/h:f5:big-ip_protocol_security_manager"], "id": "F5_BIGIP_SOL15532.NASL", "href": "https://www.tenable.com/plugins/nessus/78191", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from F5 Networks BIG-IP Solution SOL15532.\n#\n# The text description of this plugin is (C) F5 Networks.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(78191);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/10\");\n\n script_cve_id(\"CVE-2014-4023\");\n script_bugtraq_id(69449);\n\n script_name(english:\"F5 Networks BIG-IP : XSS vulnerability in echo.jsp (SOL15532)\");\n script_summary(english:\"Checks the BIG-IP version.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote device is missing a vendor-supplied security patch.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"A cross-site scripting (XSS) vulnerability exists\nintmui/dashboard/echo.jsp for the BIG-IP Configuration utility and the\nEnterprise Manager Configuration utility.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://support.f5.com/csp/article/K15532\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"Upgrade to one of the non-vulnerable versions listed in the F5\nSolution SOL15532.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_access_policy_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_advanced_firewall_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_acceleration_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_security_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_application_visibility_and_reporting\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_global_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_link_controller\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_local_traffic_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_policy_enforcement_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_wan_optimization_manager\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:f5:big-ip_webaccelerator\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/h:f5:big-ip_protocol_security_manager\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/10/28\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/08/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/10\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"F5 Networks Local Security Checks\");\n\n script_dependencies(\"f5_bigip_detect.nbin\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/BIG-IP/hotfix\", \"Host/BIG-IP/modules\", \"Host/BIG-IP/version\");\n\n exit(0);\n}\n\n\ninclude(\"f5_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nversion = get_kb_item(\"Host/BIG-IP/version\");\nif ( ! version ) audit(AUDIT_OS_NOT, \"F5 Networks BIG-IP\");\nif ( isnull(get_kb_item(\"Host/BIG-IP/hotfix\")) ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/hotfix\");\nif ( ! get_kb_item(\"Host/BIG-IP/modules\") ) audit(AUDIT_KB_MISSING, \"Host/BIG-IP/modules\");\n\nsol = \"SOL15532\";\nvmatrix = make_array();\n\n# AFM\nvmatrix[\"AFM\"] = make_array();\nvmatrix[\"AFM\"][\"affected\" ] = make_list(\"11.3.0-11.5.1\");\nvmatrix[\"AFM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\");\n\n# AM\nvmatrix[\"AM\"] = make_array();\nvmatrix[\"AM\"][\"affected\" ] = make_list(\"11.4.0-11.5.1\");\nvmatrix[\"AM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\");\n\n# APM\nvmatrix[\"APM\"] = make_array();\nvmatrix[\"APM\"][\"affected\" ] = make_list(\"11.0.0-11.5.1\",\"10.1.0-10.2.4\");\nvmatrix[\"APM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\",\"10.2.4HF12\");\n\n# ASM\nvmatrix[\"ASM\"] = make_array();\nvmatrix[\"ASM\"][\"affected\" ] = make_list(\"11.0.0-11.5.1\",\"10.1.0-10.2.4\");\nvmatrix[\"ASM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\");\n\n# AVR\nvmatrix[\"AVR\"] = make_array();\nvmatrix[\"AVR\"][\"affected\" ] = make_list(\"11.0.0-11.5.1\");\nvmatrix[\"AVR\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\");\n\n# GTM\nvmatrix[\"GTM\"] = make_array();\nvmatrix[\"GTM\"][\"affected\" ] = make_list(\"11.0.0-11.5.1\",\"10.1.0-10.2.4\");\nvmatrix[\"GTM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\",\"10.2.4HF12\");\n\n# LC\nvmatrix[\"LC\"] = make_array();\nvmatrix[\"LC\"][\"affected\" ] = make_list(\"11.0.0-11.5.1\",\"10.1.0-10.2.4\");\nvmatrix[\"LC\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\",\"10.2.4HF12\");\n\n# LTM\nvmatrix[\"LTM\"] = make_array();\nvmatrix[\"LTM\"][\"affected\" ] = make_list(\"11.0.0-11.5.1\",\"10.1.0-10.2.4\");\nvmatrix[\"LTM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\",\"10.2.4HF12\");\n\n# PEM\nvmatrix[\"PEM\"] = make_array();\nvmatrix[\"PEM\"][\"affected\" ] = make_list(\"11.3.0-11.5.1\");\nvmatrix[\"PEM\"][\"unaffected\"] = make_list(\"11.6.0\",\"11.5.2\",\"11.5.1HF6\");\n\n# PSM\nvmatrix[\"PSM\"] = make_array();\nvmatrix[\"PSM\"][\"affected\" ] = make_list(\"11.0.0-11.4.1\",\"10.1.0-10.2.4\");\nvmatrix[\"PSM\"][\"unaffected\"] = make_list(\"10.2.4HF12\");\n\n# WAM\nvmatrix[\"WAM\"] = make_array();\nvmatrix[\"WAM\"][\"affected\" ] = make_list(\"11.0.0-11.3.0\",\"10.1.0-10.2.4\");\nvmatrix[\"WAM\"][\"unaffected\"] = make_list(\"10.2.4HF12\");\n\n# WOM\nvmatrix[\"WOM\"] = make_array();\nvmatrix[\"WOM\"][\"affected\" ] = make_list(\"11.0.0-11.3.0\",\"10.1.0-10.2.4\");\nvmatrix[\"WOM\"][\"unaffected\"] = make_list(\"10.2.4HF12\");\n\n\nif (bigip_is_affected(vmatrix:vmatrix, sol:sol))\n{\n set_kb_item(name:'www/0/XSS', value:TRUE);\n if (report_verbosity > 0) security_warning(port:0, extra:bigip_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = bigip_get_tested_modules();\n audit_extra = \"For BIG-IP module(s) \" + tested + \",\";\n if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);\n else audit(AUDIT_HOST_NOT, \"running any of the affected modules\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "packetstorm": [{"lastseen": "2016-12-05T22:21:43", "description": "", "published": "2014-08-28T00:00:00", "type": "packetstorm", "title": "F5 BIG-IP 11.5.1 Cross Site Scripting", "bulletinFamily": "exploit", "cvelist": ["CVE-2014-4023"], "modified": "2014-08-28T00:00:00", "id": "PACKETSTORM:128034", "href": "https://packetstormsecurity.com/files/128034/F5-BIG-IP-11.5.1-Cross-Site-Scripting.html", "sourceData": "`-----BEGIN PGP SIGNED MESSAGE----- \nHash: SHA1 \n \nSEC Consult Vulnerability Lab Security Advisory < 20140828-0 > \n======================================================================= \ntitle: Reflected Cross-Site Scripting \nproduct: F5 BIG-IP \nvulnerable version: <= 11.5.1 \nfixed version: > 11.6.0 \nimpact: Medium \nCVE number: CVE-2014-4023 \nhomepage: https://f5.com/ \nfound: 2014-07-07 \nby: Stefan Viehb\u00f6ck \nSEC Consult Vulnerability Lab \nhttps://www.sec-consult.com \n======================================================================= \n \nVendor/product description: \n- ----------------------------- \n\"The BIG-IP product suite is a system of application delivery services that \nwork together on the same best-in-class hardware platform or software virtual \ninstance. From load balancing and service offloading to acceleration and \nsecurity, the BIG-IP system delivers agility\u0097and ensures your applications \nare fast, secure, and available.\" \n \nURL: https://f5.com/products/big-ip \n \n \nVulnerability overview/description: \n- ----------------------------------- \nBIG-IP suffers from a reflected Cross-Site Scripting vulnerability, \nwhich allow an attacker to steal other users sessions, to impersonate other \nusers and to gain unauthorized access to the admin interface. \n \n \nProof of concept: \n- ----------------- \nThe following HTTP request triggers the vulnerability: \n \nPOST /tmui/dashboard/echo.jsp HTTP/1.1 \nHost: BIGIP \nCookie: BIGIPAuthCookie=*VALID_COOKIE* \nContent-Length: 29 \n \n<script>alert('xss')</script> \n \nThe server does not properly encode user supplied information and returns it \nto the user resulting in Cross-Site Scripting. \n \n \nVulnerable / tested versions: \n- ----------------------------- \nMore information can be found at: \nhttps://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html \n \n \nVendor contact timeline: \n- ------------------------ \n2014-07-08: Sending advisory and proof of concept exploit via encrypted \nchannel. \n2014-07-09: Vendor confirms receipt of advisory. States that fix will be \nreleased in the \"next 6 weeks or so\" \n2014-07-24: Vendor provides CVE: CVE-2014-4023 \n2014-08-26: Vendor releases fixed version. \n2014-08-28: SEC Consult releases a coordinated security advisory. \n \n \nSolution: \n- --------- \nUpdate to the newest version. \n \nMore information can be found at: \nhttps://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html \n \n \nWorkaround: \n- ----------- \nNo workaround available. \n \n \nAdvisory URL: \n- ------------- \nhttps://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm \n \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \nSEC Consult Vulnerability Lab \n \nSEC Consult \nVienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius \n \nHeadquarter: \nMooslackengasse 17, 1190 Vienna, Austria \nPhone: +43 1 8903043 0 \nFax: +43 1 8903043 15 \n \nMail: research at sec-consult dot com \nWeb: https://www.sec-consult.com \nBlog: http://blog.sec-consult.com \nTwitter: https://twitter.com/sec_consult \n \nInterested in working with the experts of SEC Consult? \nWrite to career@sec-consult.com \n \nEOF Stefan Viehb\u00f6ck / @2014 \n-----BEGIN PGP SIGNATURE----- \nVersion: GnuPG v1.4.9 (MingW32) \nComment: Using GnuPG with Thunderbird - http://www.enigmail.net/ \n \niQEcBAEBAgAGBQJT/wVOAAoJECyFJyAEdlkKq9cIAKX9MEOpw8p9i8KWZXmkBiBr \nS3n9YPNk6bbGbm+YfNCvXvtdSTPhh4I1wBY/WYWENpnQrwdiJ3couS5f2/DQzHTP \nuCROxpmtxY1bokMS+ZHOPeGECk8RFr03kBZtGrF2cdGLWzBv7l+CnmopS8lnDVsw \n44/R5hj3OdZxhD3btFLXss1RPbUDU1vGV9KpDgJmsssS5pzvG9I2T9xGibd0zBIA \nWGA5jjGFitfQwDaxvqoocKgmBG2o3nQpdCShlaRiFklVJQYT1J+w/TWA1OOWZmxs \n91m6C9fqAqgeIjmFSOE5c/rpiw7MdzH46yUzoVhbqm6wKcngLDDmZDuqPwaqH18= \n=RsbU \n-----END PGP SIGNATURE----- \n`\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://packetstormsecurity.com/files/download/128034/SA-20140828-0.txt"}], "f5": [{"lastseen": "2017-06-08T00:16:30", "description": "\nF5 Product Development has assigned ID 470796 (BIG-IP) and ID 476101 (Enterprise Manager) to this vulnerability, and has evaluated the currently supported releases for potential vulnerability. Additionally, [BIG-IP iHealth](<http://www.f5.com/support/support-tools/big-ip-ihealth/>) lists Heuristic H476300 on the **Diagnostics** > **Identified** > **High** screen.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table:\n\nProduct| Versions known to be vulnerable| Versions known to be not vulnerable| Vulnerable component or feature \n---|---|---|--- \nBIG-IP LTM| 11.0.0 - 11.5.1 \n10.1.0 - 10.2.4| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9 \n10.2.4 HF12| Configuration utility \nBIG-IP AAM| 11.4.0 - 11.5.1| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9| Configuration utility \nBIG-IP AFM| 11.3.0 - 11.5.1| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9| Configuration utility \nBIG-IP Analytics| 11.0.0 - 11.5.1| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9| Configuration utility \nBIG-IP APM| 11.0.0 - 11.5.1 \n10.1.0 - 10.2.4| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9 \n10.2.4 HF12| Configuration utility \nBIG-IP ASM| 11.0.0 - 11.5.1 \n10.1.0 - 10.2.4| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9 \n10.2.4 HF12| Configuration utility \nBIG-IP Edge Gateway| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| 10.2.4 HF12| Configuration utility \nBIG-IP GTM| 11.0.0 - 11.5.1 \n10.1.0 - 10.2.4| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9 \n10.2.4 HF12| Configuration utility \nBIG-IP Link Controller| 11.0.0 - 11.5.1 \n10.1.0 - 10.2.4| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9 \n10.2.4 HF12| Configuration utility \nBIG-IP PEM| 11.3.0 - 11.5.1| 11.6.0 \n11.5.2 \n11.5.1 HF6 \n11.4.1 HF9| Configuration utility \nBIG-IP PSM| 11.0.0 - 11.4.1 \n10.1.0 - 10.2.4| 11.4.1 HF9 \n10.2.4 HF12| Configuration utility \nBIG-IP WebAccelerator| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| 10.2.4 HF12| Configuration utility \nBIG-IP WOM| 11.0.0 - 11.3.0 \n10.1.0 - 10.2.4| 10.2.4 HF12| Configuration utility \nARX| None| 6.0.0 - 6.4.0| None \nEnterprise Manager| 3.0.0 - 3.1.1 \n2.1.0 - 2.3.0| None| Configuration utility \nFirePass| None| 7.0.0 \n6.0.0 - 6.1.0| None \nBIG-IQ Cloud| None| 4.0.0 - 4.3.0| None \nBIG-IQ Device| None| 4.2.0 - 4.3.0| None \nBIG-IQ Security| None| 4.0.0 - 4.3.0| None \n \n**Note:** The hotfixes listed in the **Versions known to be not vulnerable** column address all of the aforementioned vulnerabilities.\n\nIf the previous table lists a version in the **Versions known to be not vulnerable column**, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists. \n \nTo mitigate this vulnerability, you can limit Configuration utility access to a trusted management network.\n\nF5 would like to acknowledge Stefan Viehb\u00f6ck of SEC Consult Vulnerability Lab for bringing this issue to our attention, and for following the highest standards of responsible disclosure. \n\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K13123: Managing BIG-IP product hotfixes (11.x - 12.x)](<https://support.f5.com/csp/article/K13123>)\n * [K10025: Managing BIG-IP product hotfixes (10.x)](<https://support.f5.com/csp/article/K10025>)\n * [K9502: BIG-IP hotfix matrix](<https://support.f5.com/csp/article/K9502>)\n", "cvss3": {}, "published": "2014-08-25T23:02:00", "type": "f5", "title": "XSS vulnerability in echo.jsp CVE-2014-4023", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4023"], "modified": "2017-03-14T00:51:00", "id": "F5:K15532", "href": "https://support.f5.com/csp/article/K15532", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2021-06-08T18:49:03", "description": "Vulnerability Recommended Actions\n\nIf the previous table lists a version in the **Versions known to be not vulnerable column**, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists. \n \nTo mitigate this vulnerability, you can limit Configuration utility access to a trusted management network.\n\nAcknowledgements\n\nF5 would like to acknowledge Stefan Viehb\u00c3\u00b6ck of SEC Consult Vulnerability Lab for bringing this issue to our attention, and for following the highest standards of responsible disclosure. \n\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n * SOL167: Downloading software and firmware from F5\n * SOL13123: Managing BIG-IP product hotfixes (11.x - 12.x)\n * SOL10025: Managing BIG-IP product hotfixes (10.x)\n * SOL9502: BIG-IP hotfix matrix\n", "cvss3": {}, "published": "2014-08-25T00:00:00", "type": "f5", "title": "SOL15532 - XSS vulnerability in echo.jsp CVE-2014-4023", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4023"], "modified": "2016-07-25T00:00:00", "id": "SOL15532", "href": "http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "securityvulns": [{"lastseen": "2021-06-08T18:48:58", "bulletinFamily": "software", "cvelist": ["CVE-2014-4023"], "description": "Crossite scripting via POST reuqest.", "edition": 2, "modified": "2014-09-02T00:00:00", "published": "2014-09-02T00:00:00", "id": "SECURITYVULNS:VULN:13949", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13949", "title": "F5 BIG-IP crossite scripting", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "cve": [{"lastseen": "2022-03-23T13:06:02", "description": "Cross-site scripting (XSS) vulnerability in tmui/dashboard/echo.jsp in the Configuration utility in F5 BIG-IP LTM, APM, ASM, GTM, and Link Controller 11.0.0 before 11.6.0 and 10.1.0 through 10.2.4, AAM 11.4.0 before 11.6.0, AFM and PEM 11.3.0 before 11.6.0, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0 and 10.1.0 through 10.2.4, and PSM 11.0.0 through 11.4.1 and 10.1.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "cvss3": {}, "published": "2014-10-28T14:55:00", "type": "cve", "title": "CVE-2014-4023", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4023"], "modified": "2015-08-28T15:49:00", "cpe": ["cpe:/a:f5:big-ip_wan_optimization_manager:11.1.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.5.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.1.0", "cpe:/a:f5:big-ip_webaccelerator:11.0.0", "cpe:/a:f5:big-ip_link_controller:11.2.1", "cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.0", "cpe:/a:f5:big-ip_access_policy_manager:10.2.0", "cpe:/a:f5:big-ip_application_security_manager:11.5.1", "cpe:/a:f5:big-ip_application_security_manager:10.2.4", "cpe:/a:f5:big-ip_global_traffic_manager:10.2.2", "cpe:/a:f5:big-ip_analytics:11.4.1", "cpe:/a:f5:big-ip_edge_gateway:10.2.1", "cpe:/a:f5:big-ip_edge_gateway:11.3.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.5.1", "cpe:/a:f5:big-ip_access_policy_manager:11.0.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.2.0", "cpe:/a:f5:big-ip_wan_optimization_manager:10.2.3", "cpe:/a:f5:big-ip_link_controller:11.4.1", "cpe:/a:f5:big-ip_global_traffic_manager:11.3.0", "cpe:/a:f5:big-ip_application_security_manager:10.2.3", "cpe:/a:f5:big-ip_webaccelerator:10.1.0", "cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.0", "cpe:/a:f5:big-ip_edge_gateway:11.2.0", "cpe:/a:f5:big-ip_global_traffic_manager:10.1.0", "cpe:/a:f5:big-ip_global_traffic_manager:10.2.1", "cpe:/a:f5:big-ip_global_traffic_manager:10.2.4", "cpe:/a:f5:big-ip_local_traffic_manager:10.2.2", "cpe:/a:f5:big-ip_edge_gateway:10.2.2", "cpe:/a:f5:big-ip_link_controller:11.1.0", "cpe:/a:f5:big-ip_protocol_security_module:10.1.0", "cpe:/a:f5:big-ip_link_controller:10.2.0", "cpe:/a:f5:big-ip_protocol_security_module:11.4.1", "cpe:/a:f5:big-ip_link_controller:11.0.0", "cpe:/a:f5:big-ip_application_security_manager:11.3.0", "cpe:/a:f5:big-ip_wan_optimization_manager:10.2.2", "cpe:/a:f5:big-ip_local_traffic_manager:10.2.3", "cpe:/a:f5:big-ip_link_controller:10.1.0", "cpe:/a:f5:big-ip_edge_gateway:10.2.3", "cpe:/a:f5:big-ip_access_policy_manager:11.2.1", "cpe:/a:f5:big-ip_access_policy_manager:11.4.0", "cpe:/a:f5:big-ip_application_acceleration_manager:11.4.1", "cpe:/a:f5:big-ip_link_controller:11.4.0", "cpe:/a:f5:big-ip_application_security_manager:11.5.0", "cpe:/a:f5:big-ip_access_policy_manager:10.2.2", "cpe:/a:f5:big-ip_application_acceleration_manager:11.5.1", "cpe:/a:f5:big-ip_local_traffic_manager:10.2.0", "cpe:/a:f5:big-ip_protocol_security_module:11.2.0", "cpe:/a:f5:big-ip_webaccelerator:11.1.0", "cpe:/a:f5:big-ip_wan_optimization_manager:10.1.0", "cpe:/a:f5:big-ip_analytics:11.5.1", "cpe:/a:f5:big-ip_application_acceleration_manager:11.5.0", "cpe:/a:f5:big-ip_webaccelerator:10.2.1", "cpe:/a:f5:big-ip_policy_enforcement_manager:11.4.0", "cpe:/a:f5:enterprise_manager:3.1.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.4.1", "cpe:/a:f5:big-ip_protocol_security_module:11.0.0", "cpe:/a:f5:big-ip_protocol_security_module:10.2.3", "cpe:/a:f5:big-ip_advanced_firewall_manager:11.4.0", "cpe:/a:f5:big-ip_edge_gateway:10.1.0", "cpe:/a:f5:big-ip_webaccelerator:10.2.0", "cpe:/a:f5:big-ip_advanced_firewall_manager:11.3.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.0.0", "cpe:/a:f5:big-ip_analytics:11.2.1", "cpe:/a:f5:big-ip_application_security_manager:10.2.1", "cpe:/a:f5:big-ip_global_traffic_manager:11.4.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.5.1", "cpe:/a:f5:big-ip_wan_optimization_manager:10.2.1", "cpe:/a:f5:big-ip_wan_optimization_manager:10.2.0", "cpe:/a:f5:big-ip_webaccelerator:10.2.2", "cpe:/a:f5:big-ip_wan_optimization_manager:10.2.4", "cpe:/a:f5:big-ip_webaccelerator:10.2.4", "cpe:/a:f5:big-ip_protocol_security_module:10.2.2", "cpe:/a:f5:big-ip_access_policy_manager:10.1.0", "cpe:/a:f5:big-ip_advanced_firewall_manager:11.4.1", "cpe:/a:f5:big-ip_protocol_security_module:11.3.0", "cpe:/a:f5:big-ip_edge_gateway:10.2.0", "cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.1", "cpe:/a:f5:big-ip_protocol_security_module:11.2.1", "cpe:/a:f5:enterprise_manager:3.1.1", "cpe:/a:f5:big-ip_local_traffic_manager:11.2.1", "cpe:/a:f5:big-ip_protocol_security_module:10.2.1", "cpe:/a:f5:big-ip_link_controller:11.5.0", "cpe:/a:f5:big-ip_protocol_security_module:11.1.0", "cpe:/a:f5:big-ip_wan_optimization_manager:11.3.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.1.0", "cpe:/a:f5:big-ip_wan_optimization_manager:11.0.0", "cpe:/a:f5:big-ip_wan_optimization_manager:11.2.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.4.1", "cpe:/a:f5:big-ip_wan_optimization_manager:11.2.1", "cpe:/h:f5:enterprise_manager:2.3.0", "cpe:/a:f5:big-ip_global_traffic_manager:10.2.0", "cpe:/a:f5:big-ip_application_security_manager:10.1.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.5.0", "cpe:/a:f5:big-ip_application_security_manager:11.1.0", "cpe:/a:f5:big-ip_access_policy_manager:11.2.0", "cpe:/a:f5:big-ip_policy_enforcement_manager:11.3.0", "cpe:/a:f5:big-ip_protocol_security_module:10.2.4", "cpe:/a:f5:big-ip_webaccelerator:10.2.3", "cpe:/a:f5:big-ip_access_policy_manager:10.2.3", "cpe:/a:f5:big-ip_link_controller:11.3.0", "cpe:/a:f5:big-ip_access_policy_manager:10.2.1", "cpe:/a:f5:big-ip_application_security_manager:10.2.0", "cpe:/a:f5:big-ip_local_traffic_manager:10.2.4", "cpe:/a:f5:big-ip_local_traffic_manager:11.4.0", "cpe:/a:f5:big-ip_link_controller:11.2.0", "cpe:/a:f5:big-ip_access_policy_manager:11.5.0", "cpe:/a:f5:big-ip_webaccelerator:11.2.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.0.0", "cpe:/a:f5:big-ip_application_security_manager:11.2.0", "cpe:/a:f5:big-ip_application_security_manager:10.2.2", "cpe:/a:f5:big-ip_edge_gateway:11.0.0", "cpe:/a:f5:big-ip_local_traffic_manager:10.1.0", "cpe:/h:f5:enterprise_manager:2.2.0", "cpe:/a:f5:big-ip_access_policy_manager:11.5.1", "cpe:/a:f5:big-ip_analytics:11.0.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.2.0", "cpe:/a:f5:big-ip_access_policy_manager:11.1.0", "cpe:/a:f5:big-ip_edge_gateway:11.2.1", "cpe:/a:f5:big-ip_link_controller:10.2.2", "cpe:/a:f5:big-ip_edge_gateway:11.1.0", "cpe:/h:f5:enterprise_manager:2.1.0", "cpe:/a:f5:big-ip_policy_enforcement_manager:11.4.1", "cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.1", "cpe:/a:f5:big-ip_analytics:11.2.0", "cpe:/a:f5:big-ip_access_policy_manager:11.4.1", "cpe:/a:f5:big-ip_analytics:11.4.0", "cpe:/a:f5:big-ip_application_security_manager:11.4.0", "cpe:/a:f5:big-ip_analytics:11.1.0", "cpe:/a:f5:big-ip_application_acceleration_manager:11.4.0", "cpe:/a:f5:big-ip_application_security_manager:11.4.1", "cpe:/a:f5:big-ip_link_controller:10.2.1", "cpe:/a:f5:big-ip_link_controller:11.5.1", "cpe:/a:f5:big-ip_application_security_manager:11.0.0", "cpe:/a:f5:enterprise_manager:3.0.0", "cpe:/a:f5:big-ip_global_traffic_manager:10.2.3", "cpe:/a:f5:big-ip_protocol_security_module:11.4.0", "cpe:/a:f5:big-ip_link_controller:10.2.3", "cpe:/a:f5:big-ip_protocol_security_module:10.2.0", "cpe:/a:f5:big-ip_webaccelerator:11.3.0", "cpe:/a:f5:big-ip_application_security_manager:11.2.1", "cpe:/a:f5:big-ip_analytics:11.3.0", "cpe:/a:f5:big-ip_local_traffic_manager:11.3.0", "cpe:/a:f5:big-ip_local_traffic_manager:10.2.1", "cpe:/a:f5:big-ip_link_controller:10.2.4", "cpe:/a:f5:big-ip_webaccelerator:11.2.1", "cpe:/a:f5:big-ip_edge_gateway:10.2.4", "cpe:/a:f5:big-ip_access_policy_manager:10.2.4", "cpe:/a:f5:big-ip_analytics:11.5.0", "cpe:/a:f5:big-ip_access_policy_manager:11.3.0", "cpe:/a:f5:big-ip_global_traffic_manager:11.2.1"], "id": "CVE-2014-4023", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4023", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:f5:big-ip_local_traffic_manager:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:h:f5:enterprise_manager:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:h:f5:enterprise_manager:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:f5:enterprise_manager:2.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:10.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:enterprise_manager:3.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_edge_gateway:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:10.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:f5:enterprise_manager:3.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:10.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_global_traffic_manager:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_link_controller:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_webaccelerator:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_application_security_manager:10.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_analytics:11.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_access_policy_manager:10.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:11.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:f5:big-ip_protocol_security_module:10.2.1:*:*:*:*:*:*:*"]}]}