Undisclosed BIG-IP Configuration Utility Vulnerability Allows Cross-Site Scripting Attacks

CVE-2024-27202

4.7MEDIUM

Key Information

Vendor
F5
Status
Big-ip
Vendor
CVE Published:
8 May 2024

Summary

A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Version(s)

BIG-IP < 17.1.1.3

BIG-IP < 16.1.4.3

BIG-IP < 15.1.10.4

Refferences

https://my.f5.com/manage/s/article/K000138520
vendor-advisory

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

F5 acknowledges Łukasz Rupala and Kajetan Rostojek from ING HUBS Poland for bringing this issue to our attention and following the highest standards of coordinated disclosure.
.