cve-2020-5948
Vulnerability from cvelistv5
Published
2020-12-11 18:56
Modified
2024-08-04 08:47
Severity ?
Summary
On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
References
f5sirt@f5.comhttps://support.f5.com/csp/article/K42696541Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.f5.com/csp/article/K42696541Vendor Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:47:40.959Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.f5.com/csp/article/K42696541"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIG-IP",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-11T18:56:29",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.f5.com/csp/article/K42696541"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "f5sirt@f5.com",
          "ID": "CVE-2020-5948",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIG-IP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "XSS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.f5.com/csp/article/K42696541",
              "refsource": "CONFIRM",
              "url": "https://support.f5.com/csp/article/K42696541"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2020-5948",
    "datePublished": "2020-12-11T18:56:29",
    "dateReserved": "2020-01-06T00:00:00",
    "dateUpdated": "2024-08-04T08:47:40.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"92233BA4-276B-46F4-94E2-423B8EB2074D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"29AE9C3B-C87C-4D48-8C74-A25CE73C3C97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"46362DA5-7B1C-4944-9B16-7C46FCB091EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"FD000EE7-2559-4D41-8DFD-2358F24EA804\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"A4AFCA70-BF3B-41DA-B0DE-03E91F3B372A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"E25DC6CD-8A17-4C18-A8DA-CC7BD131812D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"BA52F4CD-599A-4FAB-B172-80156A9A409D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"CA7122D0-588F-4D3E-B4D7-086413255E7C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"FFDEE0E6-3A43-40C5-896B-A993CEC4A868\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"505AA546-BE89-4BE2-8C6D-6E487716A429\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"13.1.0\", \"versionEndExcluding\": \"13.1.3.5\", \"matchCriteriaId\": \"C30C3FE3-BBA8-4CE4-BEE7-82A24F64FE7C\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"874C243A-5A16-4942-AE90-A1B0D4078192\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"81A56F9E-5939-4252-8643-0F768AE39E79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"350E17D3-C6D3-407F-B413-0D3D07A9A735\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"AF90FBA3-69FA-4053-A749-E7F635A284C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"A76C1855-461C-4539-98CD-C22363B8AFE8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"786C0192-BC78-463F-8305-E890F63F153B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"3798475B-3AA3-4DA2-A933-D49024C5C8C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"50DCC8F9-3393-4131-9B85-EBC2F9EEF4D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"75AB65FB-DC81-4F50-BC2A-BCAD1EC22635\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"66B64305-66FB-4C99-BD1A-BFE7BE23EE87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"14.1.0\", \"versionEndExcluding\": \"14.1.2.8\", \"matchCriteriaId\": \"8134C56F-5979-4501-99BC-40A9921EAAE3\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"2AE7C1F6-4D07-4D9A-835C-18CC8D71D61A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"B4E7E813-5C68-4E17-82AC-B74056FCF24A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"4E9844F8-67D6-4EDA-A850-CE34C2D4E90F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"367CAAB5-6DCD-4C2D-9075-C050FF3262AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"A479BF72-A211-4E61-BB37-309E7DB46E31\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"77AB154F-ADC2-4AD4-B246-346862D7013D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"083E3750-8499-4325-B480-040DD0836F07\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"28F451E4-B5EA-48BF-B803-595D1F11F6CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"3E85FCC0-DC5A-4201-A2ED-13DDA5169CA3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"66DD6E1E-8F8E-4228-A3CE-6A542EF81D1B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"15.0.0\", \"versionEndExcluding\": \"15.1.1\", \"matchCriteriaId\": \"AC6881E9-5B73-4615-B98D-EDD3223FF8F2\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_access_policy_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"543B57B8-C1C7-4A70-976C-6E76FCB4E2AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D52CFC7F-2A7F-4E23-8E6C-91B91436419C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_analytics:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F4FCCA87-C81C-4DB9-B5CE-E24B7C504330\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_acceleration_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"99398E30-A7D1-4A88-BE09-524DEF26C8DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_application_security_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"321CC6FB-A330-41AA-9E8D-1FC1A1E75884\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_domain_name_system:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"693F34DB-A79D-41E1-85E6-4B7BC2DCF7FE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_fraud_protection_service:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3836F05D-0EE6-441E-A498-FC3E25960CE7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_global_traffic_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7171DEF9-C5EB-490B-9BD5-4C7CB0331D61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_link_controller:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9AEF72B3-8334-4848-9835-614B6E1144FF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_local_traffic_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7543A048-FFC5-442C-A008-5E7458317F14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:16.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F65E0AC-FDE1-485F-99AA-387096A02DD9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.\"}, {\"lang\": \"es\", \"value\": \"En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1- 11.6.5.2, los endpoints no divulgados en iControl REST permiten un ataque de tipo XSS reflejado, lo que podr\\u00eda conllevar a un compromiso completo del sistema BIG-IP si el usuario v\\u00edctima se le concede el papel de administrador\"}]",
      "id": "CVE-2020-5948",
      "lastModified": "2024-11-21T05:34:53.203",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"baseScore\": 9.6, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 6.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2020-12-11T19:15:13.327",
      "references": "[{\"url\": \"https://support.f5.com/csp/article/K42696541\", \"source\": \"f5sirt@f5.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://support.f5.com/csp/article/K42696541\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "f5sirt@f5.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-5948\",\"sourceIdentifier\":\"f5sirt@f5.com\",\"published\":\"2020-12-11T19:15:13.327\",\"lastModified\":\"2024-11-21T05:34:53.203\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.\"},{\"lang\":\"es\",\"value\":\"En BIG-IP versiones 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2 y 11.6.1- 11.6.5.2, los endpoints no divulgados en iControl REST permiten un ataque de tipo XSS reflejado, lo que podr\u00eda conllevar a un compromiso completo del sistema BIG-IP si el usuario v\u00edctima se le concede el papel de administrador\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"92233BA4-276B-46F4-94E2-423B8EB2074D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"29AE9C3B-C87C-4D48-8C74-A25CE73C3C97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"46362DA5-7B1C-4944-9B16-7C46FCB091EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"FD000EE7-2559-4D41-8DFD-2358F24EA804\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"A4AFCA70-BF3B-41DA-B0DE-03E91F3B372A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"E25DC6CD-8A17-4C18-A8DA-CC7BD131812D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"BA52F4CD-599A-4FAB-B172-80156A9A409D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"CA7122D0-588F-4D3E-B4D7-086413255E7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"FFDEE0E6-3A43-40C5-896B-A993CEC4A868\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"505AA546-BE89-4BE2-8C6D-6E487716A429\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"13.1.0\",\"versionEndExcluding\":\"13.1.3.5\",\"matchCriteriaId\":\"C30C3FE3-BBA8-4CE4-BEE7-82A24F64FE7C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"874C243A-5A16-4942-AE90-A1B0D4078192\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"81A56F9E-5939-4252-8643-0F768AE39E79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"350E17D3-C6D3-407F-B413-0D3D07A9A735\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"AF90FBA3-69FA-4053-A749-E7F635A284C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"A76C1855-461C-4539-98CD-C22363B8AFE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"786C0192-BC78-463F-8305-E890F63F153B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"3798475B-3AA3-4DA2-A933-D49024C5C8C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"50DCC8F9-3393-4131-9B85-EBC2F9EEF4D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"75AB65FB-DC81-4F50-BC2A-BCAD1EC22635\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"66B64305-66FB-4C99-BD1A-BFE7BE23EE87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"14.1.0\",\"versionEndExcluding\":\"14.1.2.8\",\"matchCriteriaId\":\"8134C56F-5979-4501-99BC-40A9921EAAE3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"2AE7C1F6-4D07-4D9A-835C-18CC8D71D61A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"B4E7E813-5C68-4E17-82AC-B74056FCF24A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"4E9844F8-67D6-4EDA-A850-CE34C2D4E90F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"367CAAB5-6DCD-4C2D-9075-C050FF3262AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"A479BF72-A211-4E61-BB37-309E7DB46E31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"77AB154F-ADC2-4AD4-B246-346862D7013D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"083E3750-8499-4325-B480-040DD0836F07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"28F451E4-B5EA-48BF-B803-595D1F11F6CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"3E85FCC0-DC5A-4201-A2ED-13DDA5169CA3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"66DD6E1E-8F8E-4228-A3CE-6A542EF81D1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.0.0\",\"versionEndExcluding\":\"15.1.1\",\"matchCriteriaId\":\"AC6881E9-5B73-4615-B98D-EDD3223FF8F2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_access_policy_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"543B57B8-C1C7-4A70-976C-6E76FCB4E2AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_advanced_firewall_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D52CFC7F-2A7F-4E23-8E6C-91B91436419C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_analytics:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4FCCA87-C81C-4DB9-B5CE-E24B7C504330\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_acceleration_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"99398E30-A7D1-4A88-BE09-524DEF26C8DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_application_security_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"321CC6FB-A330-41AA-9E8D-1FC1A1E75884\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_domain_name_system:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"693F34DB-A79D-41E1-85E6-4B7BC2DCF7FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_fraud_protection_service:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3836F05D-0EE6-441E-A498-FC3E25960CE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_global_traffic_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7171DEF9-C5EB-490B-9BD5-4C7CB0331D61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_link_controller:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AEF72B3-8334-4848-9835-614B6E1144FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_local_traffic_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7543A048-FFC5-442C-A008-5E7458317F14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:f5:big-ip_policy_enforcement_manager:16.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F65E0AC-FDE1-485F-99AA-387096A02DD9\"}]}]}],\"references\":[{\"url\":\"https://support.f5.com/csp/article/K42696541\",\"source\":\"f5sirt@f5.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://support.f5.com/csp/article/K42696541\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.