On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip access policy manager12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip access policy manager13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip advanced firewall manager13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip advanced firewall manager12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip analytics12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip analytics13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip application acceleration manager13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip application acceleration manager12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip application security manager12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip application security manager13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip domain name system13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip domain name system12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip edge gateway12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip edge gateway13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip fraud protection service12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip fraud protection service13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip global traffic manager13.0.0 and later · up to 13.1.1.1 inclusive
• f5 big-ip global traffic manager12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip link controller12.1.0 and later · up to 12.1.3.6 inclusive
• f5 big-ip link controller13.0.0 and later · up to 13.1.1.1 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (f5). Independent of NVD's CPE analysis and usually ahead of it.

• F5 Networks, Inc. BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)

  • 13.0.0-13.1.1.1, 12.1.0-12.1.3.6affected

Other highest-scoring records for the same primary product.

• CVE-2018-15331On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper s
  31Monitor
• CVE-2018-5513On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to cr
  31Monitor
• CVE-2016-5736The default configuration of the IPsec IKE peer listener in F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.1 before HF16, 11.4
  31Monitor
• CVE-2016-4545Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service (resource consumptio
  31Monitor
• CVE-2018-5523On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenti
  29Monitor
• CVE-2018-15315On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configurat
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.