Multiple Cross-Site Scripting Vulnerabilities in F5 FirePass SSL VPN
CVE-2007-6704

Currently unrated

Key Information:

Vendor
F5
Status
Firepass 4100
Vendor
CVE Published:
5 March 2008

Summary

F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2, as well as versions 6.0 through 6.0.1, are susceptible to multiple cross-site scripting (XSS) vulnerabilities. These security flaws occur when pre-logon sequences are enabled, allowing remote attackers to inject arbitrary HTML or web scripts via the query string to critical server-side scripts, specifically 'my.activation.php3' and 'my.logon.php3'. Exploitation of these vulnerabilities can lead to unauthorized access and data compromise.

References

http://securityreason.com/securityalert/3712
third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/492511/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/27904
third-party-advisoryx_refsource_SECUNIA

EPSS Score

11% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.