Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title F5 Networks ASM appliance contains a cross-site scripting vulnerability
Informations
Name VU#143395 First vendor Publication 2012-09-10
Vendor VU-CERT Last vendor Modification 2012-09-10
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#143395

F5 Networks ASM appliance contains a cross-site scripting vulnerability

Original Release date: 10 Sep 2012 | Last revised: 10 Sep 2012

Overview

F5 Networks ASM appliance versions 10.0.0 through 11.2.0 HF2 are susceptible to a cross-site scripting vulnerability in the traffic overview page.

Description

A cross-site scripting (XSS) (CWE-79) vulnerability exists in the traffic overview page. By sending several malicious requests, an attacker may be able to have the requests propagate to the summary listings page where proper sanitization is not performed.

Impact

An attacker may be able to execute arbitrary script in the context of an authenticated user's session.

Solution

Apply an Update

Vendor patches (Portal authentication required) are available for supported versions.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
F5 Networks, Inc.Affected12 Jul 201210 Sep 2012
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
Temporal3.4E:POC/RL:OF/RC:C
Environmental3.4CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

  • http://www.f5.com/products/big-ip/big-ip-application-security-manager/overview
  • https://support.f5.com/kb/en-us/solutions/public/13000/800/sol13838.html
  • http://cwe.mitre.org/data/definitions/79.html

Credit

Thanks to F5 Networks for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs:CVE-2012-2975
  • Date Public:10 Sep 2012
  • Date First Published:10 Sep 2012
  • Date Last Updated:10 Sep 2012
  • Document Revision:16

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

This product is provided subject to the Notification as indicated here: http://www.us-cert.gov/legal.html#notify

Original Source

Url : http://www.kb.cert.org/vuls/id/143395

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Hardware 2

Nessus® Vulnerability Scanner

Date Description
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL13838.nasl - Type : ACT_GATHER_INFO