On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip access policy manager14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip access policy manager15.1.0 and later · up to 15.1.3 inclusive
• f5 big-ip access policy manager16.0.0 and later · up to 16.0.1.1 inclusive
• f5 big-ip advanced firewall manager14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip advanced firewall manager15.1.0 and later · up to 15.1.3 inclusive
• f5 big-ip advanced firewall manager16.0.0 and later · up to 16.0.1.1 inclusive
• f5 big-ip advanced web application firewall14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip advanced web application firewall15.1.0 and later · up to 15.1.3 inclusive
• f5 big-ip advanced web application firewall16.0.0 and later · up to 16.0.1.1 inclusive
• f5 big-ip analytics14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip analytics15.1.0 and later · up to 15.1.3 inclusive
• f5 big-ip analytics16.0.0 and later · up to 16.0.1.1 inclusive
• f5 big-ip application acceleration manager14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip application acceleration manager15.1.0 and later · up to 15.1.3 inclusive
• f5 big-ip application acceleration manager16.0.0 and later · up to 16.0.1.1 inclusive
• f5 big-ip application security manager14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip application security manager15.1.0 and later · up to 15.1.3 inclusive
• f5 big-ip application security manager16.0.0 and later · up to 16.0.1.1 inclusive
• f5 big-ip ddos hybrid defender14.1.0 and later · up to 14.1.4 inclusive
• f5 big-ip ddos hybrid defender15.1.0 and later · up to 15.1.3 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (f5). Independent of NVD's CPE analysis and usually ahead of it.

• n/a BIG-IP

  • 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3affected

Other highest-scoring records for the same primary product.

• CVE-2022-1388On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior KEV
  99Now
• CVE-2021-22986On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 KEV
  99Now
• CVE-2020-5902In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User InteKEV
  99Now

Published before and after this one in the same product

• ← EarlierCVE-2021-23025Sep 14, 2021 · On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated r
  36Monitor
• ← EarlierCVE-2021-23026Sep 14, 2021 · BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and
  35Monitor
• Later →CVE-2021-23054Sep 27, 2021 · On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cro
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.