K87502622 : iControl REST vulnerability CVE-2021-22978

Security Advisory Description

Undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. (CVE-2021-22978)

Impact

An attacker may exploit this vulnerability using a crafted URL to a reflected cross-site scripting (XSS) attack in an undisclosed page of the Configuration utility. This vulnerability is most likely to take the form of a phishing attack.