4.3
CVE-2014-3959
- EPSS 1.55%
- Veröffentlicht 03.06.2014 14:55:11
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
LoginCross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version 11.2.1
F5 ≫ Big-ip Access Policy Manager Version 11.5.1
F5 ≫ Big-ip Advanced Firewall Manager Version 11.2.1
F5 ≫ Big-ip Advanced Firewall Manager Version 11.5.1
F5 ≫ Big-ip Analytics Version 11.2.1
F5 ≫ Big-ip Analytics Version 11.5.1
F5 ≫ Big-ip Application Acceleration Manager Version 11.4.0
F5 ≫ Big-ip Application Acceleration Manager Version 11.5.1
F5 ≫ Big-ip Application Security Manager Version 11.2.1
F5 ≫ Big-ip Application Security Manager Version 11.5.1
F5 ≫ Big-ip Edge Gateway Version 11.2.1
F5 ≫ Big-ip Edge Gateway Version 11.3.0
F5 ≫ Big-ip Global Traffic Manager Version 11.2.1
F5 ≫ Big-ip Global Traffic Manager Version 11.5.1
F5 ≫ Big-ip Link Controller Version 11.2.1
F5 ≫ Big-ip Link Controller Version 11.5.1
F5 ≫ Big-ip Local Traffic Manager Version 11.2.1
F5 ≫ Big-ip Local Traffic Manager Version 11.5.1
F5 ≫ Big-ip Policy Enforcement Manager Version 11.3.0
F5 ≫ Big-ip Policy Enforcement Manager Version 11.5.1
F5 ≫ Big-ip Protocol Security Module Version 11.2.1
F5 ≫ Big-ip Protocol Security Module Version 11.4.1
F5 ≫ Big-ip Wan Optimization Manager Version 11.2.1
F5 ≫ Big-ip Wan Optimization Manager Version 11.3.0
F5 ≫ Big-ip Webaccelerator Version 11.2.1
F5 ≫ Big-ip Webaccelerator Version 11.3.0
F5 ≫ Enterprise Manager Version 3.0.0
F5 ≫ Enterprise Manager Version 3.1.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.55% | 0.717 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html
http://www.securityfocus.com/bid/67771
http://www.securitytracker.com/id/1030319
http://www.securitytracker.com/id/1030320