Stored Cross-Site Scripting Vulnerability in BIG-IP by F5 Networks
CVE-2019-6636

8.4HIGH

Key Information:

Vendor
F5
Status
Big-ip (afm, Asm)
Vendor
CVE Published:
3 July 2019

Summary

A stored cross-site scripting vulnerability exists in the AFM feed list of specific versions of BIG-IP by F5 Networks. This vulnerability allows an attacker to inject malicious scripts that could be stored and executed later as an admin user. The potential impact includes code execution and escalation of privileges for users with roles that can perform this attack, specifically resource administrators and administrators. Prompt updates and patches are recommended to mitigate this risk.

Affected Version(s)

BIG-IP (AFM, ASM) BIG-IP (AFM

BIG-IP (AFM, ASM) ASM) 14.1.0-14.1.0.5

BIG-IP (AFM, ASM) 14.0.0-14.0.0.4

References

https://support.f5.com/csp/article/K68151373
x_refsource_CONFIRM
http://www.securityfocus.com/bid/109108
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.