VulnerabilityModified

CVE-2014-4023

MEDIUM 4.3EPSS 1.84%

Does this matter?

Lower severity and a low EPSS score (1.84%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site scripting (XSS) vulnerability in tmui/dashboard/echo.jsp in the Configuration utility in F5 BIG-IP LTM, APM, ASM, GTM, and Link Controller 11.0.0 before 11.6.0 and 10.1.0 through 10.2.4, AAM 11.4.0 before 11.6.0, AFM and PEM 11.3.0 before 11.6.0, Analytics 11.0.0 through 11.5.1, Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0 and 10.1.0 through 10.2.4, and PSM 11.0.0 through 11.4.1 and 10.1.0 through 10.2.4 and Enterprise Manager 3.0.0 through 3.1.1 and 2.1.0 through 2.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 1.84% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: f5/big-ip advanced firewall manager · f5/big-ip policy enforcement manager · f5/big-ip application security manager · f5/big-ip application acceleration manager · f5/enterprise manager · f5/big-ip edge gateway · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip access policy manager · f5/big-ip protocol security module · f5/big-ip webaccelerator · f5/big-ip wan optimization manager · f5/big-ip analytics
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.