CVE-2014-3959

Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html	Vendor Advisory
http://www.securityfocus.com/bid/67771	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030319	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030320	Third Party Advisory VDB Entry
http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html	Vendor Advisory
http://www.securityfocus.com/bid/67771	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030319	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030320	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:big-ip_access_policy_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_analytics:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_analytics:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:::::::*
	cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_application_security_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_edge_gateway:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_edge_gateway:11.3.0:::::::*
	cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_link_controller:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_link_controller:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.3.0:::::::*
	cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:::::::*
	cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:::::::*
	cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.3.0:::::::*
	cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:::::::*
	cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:::::::*
	cpe:2.3:a:f5:enterprise_manager:3.0.0:::::::*
	cpe:2.3:a:f5:enterprise_manager:3.1.1:::::::*

History

21 Nov 2024, 02:09

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/58969 -~~	() http://secunia.com/advisories/58969 -
References	~~() http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html - Vendor Advisory~~	() http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/67771 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/67771 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1030319 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1030319 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1030320 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1030320 - Third Party Advisory, VDB Entry

Information

Published : 2014-06-03 14:55

Updated : 2024-11-21 02:09

NVD link : CVE-2014-3959

Mitre link : CVE-2014-3959

CVE.ORG link : CVE-2014-3959

JSON object : View

Products Affected

big-ip_advanced_firewall_manager
big-ip_analytics
big-ip_application_acceleration_manager
big-ip_link_controller
big-ip_access_policy_manager
big-ip_wan_optimization_manager
big-ip_global_traffic_manager
big-ip_application_security_manager
enterprise_manager
big-ip_local_traffic_manager
big-ip_webaccelerator
big-ip_protocol_security_module
big-ip_policy_enforcement_manager
big-ip_edge_gateway

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-3959", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-06-03T14:55:11.490", "references": [{"url": "http://secunia.com/advisories/58969", "source": "cve@mitre.org"}, {"url": "http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/67771", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1030319", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1030320", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/58969", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/67771", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1030319", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1030320", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters."}, {"lang": "es", "value": "Vulnerabilidad de XSS en list.jsp en la utilidad de configuraci\u00f3n en F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM y Link Controller 11.2.1 hasta 11.5.1, AAM 11.4.0 hasta 11.5.1, PEM 11.3.0 hasta 11.5.1, PSM 11.2.1 hasta 11.4.1, WebAccelerator y WOM 11.2.1 hasta 11.3.0 y Enterprise Manager 3.0.0 hasta 3.1.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de par\u00e1metros no especificados."}], "lastModified": "2024-11-21T02:09:13.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB630A86-FB84-4199-9E4D-38EB620806CB"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC6C5628-14FF-4D75-B62E-D4B2707C1E3D"}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FDC1C0F-A00A-456C-AB51-CD139B15CB61"}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA244A7D-F65D-4114-81C8-CE811959EA10"}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "867B2CA9-DAE5-4070-B8E6-F624C59F5054"}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B33B2082-E040-4799-A260-BA687ED8614E"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "974C5213-99F7-4E8A-AC6A-8759697F19C4"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4489382-0668-4CFB-BA89-D54762937CEE"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A635FEC4-4F52-4971-A67D-47E68108E4F4"}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "855E91A4-0A0C-4E5C-8019-FB513A793803"}, {"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3136A8D1-3D0D-46B3-9A3A-737074864F1B"}, {"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:11.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96673865-3D37-4562-831E-3ACE9DFB471E"}, {"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84452450-77FA-4708-9C86-5464D541C8ED"}, {"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B50BF19F-71B4-47C0-A96E-6EB90FCC6AE7"}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DD53088-3BD4-4AF9-8934-4905231A75E8"}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB017D7A-3290-4EF5-9647-B488771A5F32"}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9EA336A-8055-4DA8-8F79-07C4ADE83E32"}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12F86EB5-D581-4103-A802-44D968BA8D55"}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CA52816-C4B7-4B1E-A950-EE9B571CB06B"}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D379372-A226-4230-B1F3-04C696518BD8"}, {"criteria": "cpe:2.3:a:f5:big-ip_protocol_security_module:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA54B88F-4A16-4F40-8A3B-B107F0CA2334"}, {"criteria": "cpe:2.3:a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFE665CF-A633-474E-9519-D20E3D3958CF"}, {"criteria": "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FBA20ED-08F5-4C35-991A-0DBC6BEAECC7"}, {"criteria": "cpe:2.3:a:f5:big-ip_wan_optimization_manager:11.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D94751C-A340-4DE7-821A-5143FA0011E4"}, {"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF7FCC81-2F1D-4EF5-956B-085FB7FEFAE7"}, {"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:11.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "200A9CE9-E56D-4EFA-AC8A-954F945DDDBB"}, {"criteria": "cpe:2.3:a:f5:enterprise_manager:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "125C8A19-4F51-42DD-BA11-F299721EFBB5"}, {"criteria": "cpe:2.3:a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5F5FEE7-059A-4A9B-BCCD-18F0AA435040"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

4.3 /10