Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-4023

Cross-site scripting (XSS) vulnerability in tmui/dashboard/echo.jsp in the Configuration utility in F5 BIG-IP LTM, APM, ASM, GTM, and Link Controller 11.0.0 before 11.6.0 and 10.1.0 through 10.2.4, AAM 11.4.0 before 11.6.0, AFM and PEM 11.3.0 before 11.6.0, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0 and 10.1.0 through 10.2.4, and PSM 11.0.0 through 11.4.1 and 10.1.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published

2014-10-28T14:55:05.987

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	f5	big-ip_advanced_firewall_manager	11.3.0	Yes
Application	f5	big-ip_advanced_firewall_manager	11.4.0	Yes
Application	f5	big-ip_advanced_firewall_manager	11.4.1	Yes
Application	f5	big-ip_advanced_firewall_manager	11.5.0	Yes
Application	f5	big-ip_advanced_firewall_manager	11.5.1	Yes
Application	f5	big-ip_policy_enforcement_manager	11.3.0	Yes
Application	f5	big-ip_policy_enforcement_manager	11.4.0	Yes
Application	f5	big-ip_policy_enforcement_manager	11.4.1	Yes
Application	f5	big-ip_policy_enforcement_manager	11.5.0	Yes
Application	f5	big-ip_policy_enforcement_manager	11.5.1	Yes
Application	f5	big-ip_application_security_manager	10.1.0	Yes
Application	f5	big-ip_application_security_manager	10.2.0	Yes
Application	f5	big-ip_application_security_manager	10.2.1	Yes
Application	f5	big-ip_application_security_manager	10.2.2	Yes
Application	f5	big-ip_application_security_manager	10.2.3	Yes
Application	f5	big-ip_application_security_manager	10.2.4	Yes
Application	f5	big-ip_application_security_manager	11.0.0	Yes
Application	f5	big-ip_application_security_manager	11.1.0	Yes
Application	f5	big-ip_application_security_manager	11.2.0	Yes
Application	f5	big-ip_application_security_manager	11.2.1	Yes
Application	f5	big-ip_application_security_manager	11.3.0	Yes
Application	f5	big-ip_application_security_manager	11.4.0	Yes
Application	f5	big-ip_application_security_manager	11.4.1	Yes
Application	f5	big-ip_application_security_manager	11.5.0	Yes
Application	f5	big-ip_application_security_manager	11.5.1	Yes
Application	f5	big-ip_application_acceleration_manager	11.4.0	Yes
Application	f5	big-ip_application_acceleration_manager	11.4.1	Yes
Application	f5	big-ip_application_acceleration_manager	11.5.0	Yes
Application	f5	big-ip_application_acceleration_manager	11.5.1	Yes
Application	f5	enterprise_manager	3.0.0	Yes
Application	f5	enterprise_manager	3.1.0	Yes
Application	f5	enterprise_manager	3.1.1	Yes
Hardware	f5	enterprise_manager	2.1.0	Yes
Hardware	f5	enterprise_manager	2.2.0	Yes
Hardware	f5	enterprise_manager	2.3.0	Yes
Application	f5	big-ip_edge_gateway	10.1.0	Yes
Application	f5	big-ip_edge_gateway	10.2.0	Yes
Application	f5	big-ip_edge_gateway	10.2.1	Yes
Application	f5	big-ip_edge_gateway	10.2.2	Yes
Application	f5	big-ip_edge_gateway	10.2.3	Yes
Application	f5	big-ip_edge_gateway	10.2.4	Yes
Application	f5	big-ip_edge_gateway	11.0.0	Yes
Application	f5	big-ip_edge_gateway	11.1.0	Yes
Application	f5	big-ip_edge_gateway	11.2.0	Yes
Application	f5	big-ip_edge_gateway	11.2.1	Yes
Application	f5	big-ip_edge_gateway	11.3.0	Yes
Application	f5	big-ip_global_traffic_manager	10.1.0	Yes
Application	f5	big-ip_global_traffic_manager	10.2.0	Yes
Application	f5	big-ip_global_traffic_manager	10.2.1	Yes
Application	f5	big-ip_global_traffic_manager	10.2.2	Yes
Application	f5	big-ip_global_traffic_manager	10.2.3	Yes
Application	f5	big-ip_global_traffic_manager	10.2.4	Yes
Application	f5	big-ip_global_traffic_manager	11.0.0	Yes
Application	f5	big-ip_global_traffic_manager	11.1.0	Yes
Application	f5	big-ip_global_traffic_manager	11.2.0	Yes
Application	f5	big-ip_global_traffic_manager	11.2.1	Yes
Application	f5	big-ip_global_traffic_manager	11.3.0	Yes
Application	f5	big-ip_global_traffic_manager	11.4.0	Yes
Application	f5	big-ip_global_traffic_manager	11.4.1	Yes
Application	f5	big-ip_global_traffic_manager	11.5.0	Yes
Application	f5	big-ip_global_traffic_manager	11.5.1	Yes
Application	f5	big-ip_link_controller	10.1.0	Yes
Application	f5	big-ip_link_controller	10.2.0	Yes
Application	f5	big-ip_link_controller	10.2.1	Yes
Application	f5	big-ip_link_controller	10.2.2	Yes
Application	f5	big-ip_link_controller	10.2.3	Yes
Application	f5	big-ip_link_controller	10.2.4	Yes
Application	f5	big-ip_link_controller	11.0.0	Yes
Application	f5	big-ip_link_controller	11.1.0	Yes
Application	f5	big-ip_link_controller	11.2.0	Yes
Application	f5	big-ip_link_controller	11.2.1	Yes
Application	f5	big-ip_link_controller	11.3.0	Yes
Application	f5	big-ip_link_controller	11.4.0	Yes
Application	f5	big-ip_link_controller	11.4.1	Yes
Application	f5	big-ip_link_controller	11.5.0	Yes
Application	f5	big-ip_link_controller	11.5.1	Yes
Application	f5	big-ip_local_traffic_manager	10.1.0	Yes
Application	f5	big-ip_local_traffic_manager	10.2.0	Yes
Application	f5	big-ip_local_traffic_manager	10.2.1	Yes
Application	f5	big-ip_local_traffic_manager	10.2.2	Yes
Application	f5	big-ip_local_traffic_manager	10.2.3	Yes
Application	f5	big-ip_local_traffic_manager	10.2.4	Yes
Application	f5	big-ip_local_traffic_manager	11.0.0	Yes
Application	f5	big-ip_local_traffic_manager	11.1.0	Yes
Application	f5	big-ip_local_traffic_manager	11.2.0	Yes
Application	f5	big-ip_local_traffic_manager	11.2.1	Yes
Application	f5	big-ip_local_traffic_manager	11.3.0	Yes
Application	f5	big-ip_local_traffic_manager	11.4.0	Yes
Application	f5	big-ip_local_traffic_manager	11.4.1	Yes
Application	f5	big-ip_local_traffic_manager	11.5.0	Yes
Application	f5	big-ip_local_traffic_manager	11.5.1	Yes
Application	f5	big-ip_access_policy_manager	10.1.0	Yes
Application	f5	big-ip_access_policy_manager	10.2.0	Yes
Application	f5	big-ip_access_policy_manager	10.2.1	Yes
Application	f5	big-ip_access_policy_manager	10.2.2	Yes
Application	f5	big-ip_access_policy_manager	10.2.3	Yes
Application	f5	big-ip_access_policy_manager	10.2.4	Yes
Application	f5	big-ip_access_policy_manager	11.0.0	Yes
Application	f5	big-ip_access_policy_manager	11.1.0	Yes
Application	f5	big-ip_access_policy_manager	11.2.0	Yes
Application	f5	big-ip_access_policy_manager	11.2.1	Yes
Application	f5	big-ip_access_policy_manager	11.3.0	Yes
Application	f5	big-ip_access_policy_manager	11.4.0	Yes
Application	f5	big-ip_access_policy_manager	11.4.1	Yes
Application	f5	big-ip_access_policy_manager	11.5.0	Yes
Application	f5	big-ip_access_policy_manager	11.5.1	Yes
Application	f5	big-ip_protocol_security_module	10.1.0	Yes
Application	f5	big-ip_protocol_security_module	10.2.0	Yes
Application	f5	big-ip_protocol_security_module	10.2.1	Yes
Application	f5	big-ip_protocol_security_module	10.2.2	Yes
Application	f5	big-ip_protocol_security_module	10.2.3	Yes
Application	f5	big-ip_protocol_security_module	10.2.4	Yes
Application	f5	big-ip_protocol_security_module	11.0.0	Yes
Application	f5	big-ip_protocol_security_module	11.1.0	Yes
Application	f5	big-ip_protocol_security_module	11.2.0	Yes
Application	f5	big-ip_protocol_security_module	11.2.1	Yes
Application	f5	big-ip_protocol_security_module	11.3.0	Yes
Application	f5	big-ip_protocol_security_module	11.4.0	Yes
Application	f5	big-ip_protocol_security_module	11.4.1	Yes
Application	f5	big-ip_webaccelerator	10.1.0	Yes
Application	f5	big-ip_webaccelerator	10.2.0	Yes
Application	f5	big-ip_webaccelerator	10.2.1	Yes
Application	f5	big-ip_webaccelerator	10.2.2	Yes
Application	f5	big-ip_webaccelerator	10.2.3	Yes
Application	f5	big-ip_webaccelerator	10.2.4	Yes
Application	f5	big-ip_webaccelerator	11.0.0	Yes
Application	f5	big-ip_webaccelerator	11.1.0	Yes
Application	f5	big-ip_webaccelerator	11.2.0	Yes
Application	f5	big-ip_webaccelerator	11.2.1	Yes
Application	f5	big-ip_webaccelerator	11.3.0	Yes
Application	f5	big-ip_wan_optimization_manager	10.1.0	Yes
Application	f5	big-ip_wan_optimization_manager	10.2.0	Yes
Application	f5	big-ip_wan_optimization_manager	10.2.1	Yes
Application	f5	big-ip_wan_optimization_manager	10.2.2	Yes
Application	f5	big-ip_wan_optimization_manager	10.2.3	Yes
Application	f5	big-ip_wan_optimization_manager	10.2.4	Yes
Application	f5	big-ip_wan_optimization_manager	11.0.0	Yes
Application	f5	big-ip_wan_optimization_manager	11.1.0	Yes
Application	f5	big-ip_wan_optimization_manager	11.2.0	Yes
Application	f5	big-ip_wan_optimization_manager	11.2.1	Yes
Application	f5	big-ip_wan_optimization_manager	11.3.0	Yes
Application	f5	big-ip_analytics	11.0.0	Yes
Application	f5	big-ip_analytics	11.1.0	Yes
Application	f5	big-ip_analytics	11.2.0	Yes
Application	f5	big-ip_analytics	11.2.1	Yes
Application	f5	big-ip_analytics	11.3.0	Yes
Application	f5	big-ip_analytics	11.4.0	Yes
Application	f5	big-ip_analytics	11.4.1	Yes
Application	f5	big-ip_analytics	11.5.0	Yes
Application	f5	big-ip_analytics	11.5.1	Yes

References

http://www.securitytracker.com/id/1030776 ([email protected])
https://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html Vendor Advisory ([email protected])
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140828-F5_BIG-IP_Reflected_XSS_v10.txt Exploit ([email protected])
http://www.securitytracker.com/id/1030776 (af854a3a-2127-422b-91ae-364da2661108)
https://support.f5.com/kb/en-us/solutions/public/15000/500/sol15532.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140828-F5_BIG-IP_Reflected_XSS_v10.txt Exploit (af854a3a-2127-422b-91ae-364da2661108)