VulnerabilityModified

CVE-2016-7469

MEDIUM 5.4EPSS 0.95%

Does this matter?

Lower severity and a low EPSS score (0.95%). Track it; it rarely justifies an emergency change on its own.

Description

A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable.

CVSS 3.0: 5.4 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.95% probability · 59th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: f5/big-ip local traffic manager · f5/big-ip application acceleration manager · f5/big-ip advanced firewall manager · f5/big-ip analytics · f5/big-ip access policy manager · f5/big-ip application security manager · f5/big-ip domain name system · f5/big-ip edge gateway · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip policy enforcement manager · f5/big-ip protocol security module · f5/big-ip webaccelerator · f5/big-ip websafe · f5/big-ip wan optimization manager · f5/enterprise manager
Source: f5sirt@f5.com

References

http://www.securityfocus.com/bid/95320Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037559
http://www.securitytracker.com/id/1037560
https://support.f5.com/csp/article/K97285349Vendor Advisory
http://www.securityfocus.com/bid/95320Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037559
http://www.securitytracker.com/id/1037560
https://support.f5.com/csp/article/K97285349Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.