CVE-2014-3959

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-3959
Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html Vendor Advisory
http://www.securityfocus.com/bid/67771 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030319 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030320 Third Party Advisory VDB Entry
http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html Vendor Advisory
http://www.securityfocus.com/bid/67771 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030319 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030320 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:f5:big-ip_access_policy_manager:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_edge_gateway:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_edge_gateway:11.3.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.3.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.3.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:enterprise_manager:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*
History

21 Nov 2024, 02:09

Type Values Removed Values Added
References () http://secunia.com/advisories/58969 - () http://secunia.com/advisories/58969 -
References () http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html - Vendor Advisory () http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html - Vendor Advisory
References () http://www.securityfocus.com/bid/67771 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/67771 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1030319 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1030319 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1030320 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1030320 - Third Party Advisory, VDB Entry
Information

Published : 2014-06-03 14:55

Updated : 2024-11-21 02:09

NVD link : CVE-2014-3959

Mitre link : CVE-2014-3959

CVE.ORG link : CVE-2014-3959

JSON object : View

Products Affected

f5

  • big-ip_advanced_firewall_manager
  • big-ip_analytics
  • big-ip_application_acceleration_manager
  • big-ip_link_controller
  • big-ip_access_policy_manager
  • big-ip_wan_optimization_manager
  • big-ip_global_traffic_manager
  • big-ip_application_security_manager
  • enterprise_manager
  • big-ip_local_traffic_manager
  • big-ip_webaccelerator
  • big-ip_protocol_security_module
  • big-ip_policy_enforcement_manager
  • big-ip_edge_gateway
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')