BIG-IP Configuration utility vulnerability

CVE-2023-38138

6.1MEDIUM

Key Information

Vendor: F5
Status: BIG-IP
Vendor: CVE Published:; 2 August 2023

Summary

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Version(s)

BIG-IP < 17.1.0.2

BIG-IP < 16.1.3.5

BIG-IP < 15.1.9.1

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
Aug 2, 2023
Vulnerability Reserved.
Jul 17, 2023

Collectors

NVD DatabaseMitre Database

Credit

F5 acknowledges Maksymilian Kubiak, Sławomir Zakrzewski and Karol Mazurek of AFINE Sp. z o.o. for bringing this issue to our attention and following the highest standards of coordinated disclosure.