Details of VAR-201406-0249

ID

VAR-201406-0249

CVE

CVE-2014-3959

TITLE

plural F5 BIG-IP Product Configuration Utility cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-002746

DESCRIPTION

Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Multiple F5 BIG-IP and Enterprise Manager products are prone to a multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML

Trust: 1.98

sources: NVD: CVE-2014-3959 // JVNDB: JVNDB-2014-002746 // BID: 67771 // VULHUB: VHN-71899

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip edge gateway	scope:	eq	version:	11.2.1	Trust: 1.6
vendor:	f5	model:	big-ip edge gateway	scope:	eq	version:	11.3.0	Trust: 1.6
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	11.5.1	Trust: 1.6
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	11.2.1	Trust: 1.6
vendor:	f5	model:	big-ip global traffic manager	scope:	eq	version:	11.5.1	Trust: 1.6
vendor:	f5	model:	big-ip global traffic manager	scope:	eq	version:	11.2.1	Trust: 1.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.1	Trust: 1.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.2.1	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	11.5.1	Trust: 1.6
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	11.2.1	Trust: 1.6
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	11.4.0	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	11.2.1	Trust: 1.0
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	11.5.1	Trust: 1.0
vendor:	f5	model:	enterprise manager	scope:	eq	version:	3.1.1	Trust: 1.0
vendor:	f5	model:	big-ip protocol security module	scope:	eq	version:	11.4.1	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	11.5.1	Trust: 1.0
vendor:	f5	model:	enterprise manager	scope:	eq	version:	3.0.0	Trust: 1.0
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	11.3.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	11.2.1	Trust: 1.0
vendor:	f5	model:	big-ip protocol security module	scope:	eq	version:	11.2.1	Trust: 1.0
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	11.5.1	Trust: 1.0
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	11.2.1	Trust: 1.0
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	11.5.1	Trust: 1.0
vendor:	f5	model:	big-ip wan optimization manager	scope:	eq	version:	11.2.1	Trust: 1.0
vendor:	f5	model:	big-ip webaccelerator	scope:	eq	version:	11.2.1	Trust: 1.0
vendor:	f5	model:	big-ip webaccelerator	scope:	eq	version:	11.3.0	Trust: 1.0
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	11.5.1	Trust: 1.0
vendor:	f5	model:	big-ip wan optimization manager	scope:	eq	version:	11.3.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip advanced firewall manager	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip analytics	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip application acceleration manager	scope:	eq	version:	11.4.0 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip application security manager	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip edge gateway	scope:	eq	version:	11.2.1 to 11.3.0	Trust: 0.8
vendor:	f5	model:	big-ip global traffic manager	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip link controller	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip local traffic manager	scope:	eq	version:	11.2.1 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip policy enforcement manager	scope:	eq	version:	11.3.0 to 11.5.1	Trust: 0.8
vendor:	f5	model:	big-ip protocol security module	scope:	eq	version:	11.2.1 to 11.4.1	Trust: 0.8
vendor:	f5	model:	big-ip wan optimization manager	scope:	eq	version:	11.2.1 to 11.3.0	Trust: 0.8
vendor:	f5	model:	big-ip webaccelerator	scope:	eq	version:	11.2.1 to 11.3.0	Trust: 0.8
vendor:	f5	model:	enterprise manager software	scope:	eq	version:	3.0.0 to 3.1.1	Trust: 0.8

sources: JVNDB: JVNDB-2014-002746 // CNNVD: CNNVD-201406-031 // NVD: CVE-2014-3959

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-3959
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-3959
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201406-031
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-71899
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-3959
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-71899
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-71899 // JVNDB: JVNDB-2014-002746 // CNNVD: CNNVD-201406-031 // NVD: CVE-2014-3959

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-71899 // JVNDB: JVNDB-2014-002746 // NVD: CVE-2014-3959

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201406-031

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201406-031

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-002746

PATCH

title:

SOL15296: XSS vulnerability in list.jsp

url:

http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html

Trust: 0.8

sources: JVNDB: JVNDB-2014-002746

EXTERNAL IDS

db:	NVD	id:	CVE-2014-3959	Trust: 2.8
db:	SECUNIA	id:	58969	Trust: 1.7
db:	BID	id:	67771	Trust: 1.4
db:	SECTRACK	id:	1030320	Trust: 1.1
db:	SECTRACK	id:	1030319	Trust: 1.1
db:	JVNDB	id:	JVNDB-2014-002746	Trust: 0.8
db:	CNNVD	id:	CNNVD-201406-031	Trust: 0.7
db:	VULHUB	id:	VHN-71899	Trust: 0.1

sources: VULHUB: VHN-71899 // BID: 67771 // JVNDB: JVNDB-2014-002746 // CNNVD: CNNVD-201406-031 // NVD: CVE-2014-3959

REFERENCES

url:	http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.html	Trust: 1.7
url:	http://secunia.com/advisories/58969	Trust: 1.7
url:	http://www.securityfocus.com/bid/67771	Trust: 1.1
url:	http://www.securitytracker.com/id/1030319	Trust: 1.1
url:	http://www.securitytracker.com/id/1030320	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3959	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3959	Trust: 0.8
url:	http://www.f5.com/products/big-ip/	Trust: 0.3

sources: VULHUB: VHN-71899 // BID: 67771 // JVNDB: JVNDB-2014-002746 // CNNVD: CNNVD-201406-031 // NVD: CVE-2014-3959

CREDITS

F5 Networks

Trust: 0.3

sources: BID: 67771

SOURCES

db:	VULHUB	id:	VHN-71899
db:	BID	id:	67771
db:	JVNDB	id:	JVNDB-2014-002746
db:	CNNVD	id:	CNNVD-201406-031
db:	NVD	id:	CVE-2014-3959

LAST UPDATE DATE

2024-11-23T22:35:07.314000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-71899	date:	2016-10-19T00:00:00
db:	BID	id:	67771	date:	2015-03-19T09:05:00
db:	JVNDB	id:	JVNDB-2014-002746	date:	2014-06-05T00:00:00
db:	CNNVD	id:	CNNVD-201406-031	date:	2014-06-05T00:00:00
db:	NVD	id:	CVE-2014-3959	date:	2024-11-21T02:09:13.237

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-71899	date:	2014-06-03T00:00:00
db:	BID	id:	67771	date:	2014-05-29T00:00:00
db:	JVNDB	id:	JVNDB-2014-002746	date:	2014-06-05T00:00:00
db:	CNNVD	id:	CNNVD-201406-031	date:	2014-06-05T00:00:00
db:	NVD	id:	CVE-2014-3959	date:	2014-06-03T14:55:11.490