Description
A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages Impact: An attacker may trick authenticated BIG-IP users into accessing malicious links and reflect a spoofed error message in the victim's BIG-IP Configuration utility web browser session. This is a control plane issue; there is no data plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
High
Attack Requirements
None
Privileges Required
None
User Interaction
Passive
Confidentiality (Vulnerable System)
None
Integrity (Vulnerable System)
Low
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- F5 / BIG-IP21.1.0 – 21.1.0.1
- F5 / BIG-IP21.0.0 – 21.0.0.3
- F5 / BIG-IP17.5.0 – 17.5.1.8
- F5 / BIG-IP17.1.0 – 17.1.3.4
- F5 / big-ip_access_policy_manager17.1.0 – 17.1.3
- F5 / big-ip_advanced_firewall_manager17.1.0 – 17.1.3
- F5 / big-ip_advanced_web_application_firewall17.1.0 – 17.1.3
- F5 / big-ip_analytics17.1.0 – 17.1.3
- F5 / big-ip_application_acceleration_manager17.1.0 – 17.1.3
- F5 / big-ip_application_security_manager17.1.0 – 17.1.3
- F5 / big-ip_application_visibility_and_reporting17.1.0 – 17.1.3
- F5 / big-ip_automation_toolchain17.1.0 – 17.1.3
- F5 / big-ip_carrier-grade_nat17.1.0 – 17.1.3
- F5 / big-ip_container_ingress_services17.1.0 – 17.1.3
- F5 / big-ip_ddos_hybrid_defender17.1.0 – 17.1.3
- F5 / big-ip_domain_name_system17.1.0 – 17.1.3
- F5 / big-ip_edge_gateway17.1.0 – 17.1.3
- F5 / big-ip_fraud_protection_service17.1.0 – 17.1.3
- F5 / big-ip_global_traffic_manager17.1.0 – 17.1.3
- F5 / big-ip_link_controller17.1.0 – 17.1.3
- F5 / big-ip_local_traffic_manager17.1.0 – 17.1.3
- F5 / big-ip_policy_enforcement_manager17.1.0 – 17.1.3
- F5 / big-ip_ssl_orchestrator17.1.0 – 17.1.3
- F5 / big-ip_webaccelerator17.1.0 – 17.1.3
- F5 / big-ip_websafe17.1.0 – 17.1.3
References
Updated 11m ago · 8 sources