Cross site scripting

2021-03-3118:15:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.1%

JSON

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CPENameOperatorVersion
big-ip_access_policy_managerge16.0.0
big-ip_access_policy_managerlt16.0.1.1
big-ip_access_policy_managerge13.1.0
big-ip_access_policy_managerlt13.1.3.6
big-ip_access_policy_managerge15.1.0
big-ip_access_policy_managerlt15.1.2.1
big-ip_access_policy_managerge12.1.0
big-ip_access_policy_managerlt12.1.5.3
big-ip_access_policy_managerge14.1.0
big-ip_access_policy_managerlt14.1.4

Name	Operator	Version
big-ip_access_policy_manager	ge	16.0.0
big-ip_access_policy_manager	lt	16.0.1.1
big-ip_access_policy_manager	ge	13.1.0
big-ip_access_policy_manager	lt	13.1.3.6
big-ip_access_policy_manager	ge	15.1.0
big-ip_access_policy_manager	lt	15.1.2.1
big-ip_access_policy_manager	ge	12.1.0
big-ip_access_policy_manager	lt	12.1.5.3
big-ip_access_policy_manager	ge	14.1.0
big-ip_access_policy_manager	lt	14.1.4