Reflected Cross-Site Scripting Vulnerability in F5 BIG-IP APM
CVE-2021-23054

6.1MEDIUM

Key Information:

Vendor

F5
Status
Big-ip Apm
Vendor
CVE Published:
27 September 2021

What is CVE-2021-23054?

A reflected cross-site scripting vulnerability has been identified in the resource information page of authenticated users on the F5 BIG-IP APM system. This vulnerability occurs when the system is set up with a full webtop configuration. Affected versions include various iterations from 11.6.x through 16.x. Attackers could exploit this vulnerability to launch XSS attacks, potentially allowing them to execute malicious scripts in the context of the user’s browser, compromising sensitive information.

Affected Version(s)

BIG-IP APM 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x

References

https://support.f5.com/csp/article/K41997459
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.