NetSight
IP …
medium5.4

CVE-2016-7469

A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge …

Impact

A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable.

Affected products

VendorProductAffected versions
F5Big-Ip Local Traffic Manager
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Application Acceleration Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Advanced Firewall Manager
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Analytics
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Access Policy Manager
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Application Security Manager
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Domain Name System
Versions 12.0.0, 12.1.0, 12.1.1, 12.1.2
F5Big-Ip Edge Gateway
Version 11.2.1
F5Big-Ip Global Traffic Manager
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Link Controller
Versions 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2
F5Big-Ip Policy Enforcement Manager
Versions 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3
F5Big-Ip Protocol Security Module
Versions 11.4.0, 11.4.1

Weakness classification

CWE-79

References