Sign-up

ID

VAR-201810-0911


CVE

CVE-2018-15315


TITLE

F5 BIG-IP Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2018-011232

DESCRIPTION

On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page. F5 BIG-IP Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Trust: 1.71

sources: NVD: CVE-2018-15315 // JVNDB: JVNDB-2018-011232 // VULHUB: VHN-125562

AFFECTED PRODUCTS

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.2

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.3

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.1

Trust: 0.6

sources: JVNDB: JVNDB-2018-011232 // CNNVD: CNNVD-201810-1093 // NVD: CVE-2018-15315

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15315
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-15315
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201810-1093
value: MEDIUM

Trust: 0.6

VULHUB: VHN-125562
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-15315
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125562
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15315
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125562 // JVNDB: JVNDB-2018-011232 // CNNVD: CNNVD-201810-1093 // NVD: CVE-2018-15315

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-125562 // JVNDB: JVNDB-2018-011232 // NVD: CVE-2018-15315

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1093

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201810-1093

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-011232

PATCH
title:K41704442url:https://support.f5.com/csp/article/K41704442
Trust: 0.8
title:F5 BIG-IP Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86219
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-011232 // 
            
            
            
            CNNVD: CNNVD-201810-1093

EXTERNAL IDS
db:NVDid:CVE-2018-15315
Trust: 2.5
db:SECTRACKid:1041935
Trust: 1.1
db:JVNDBid:JVNDB-2018-011232
Trust: 0.8
db:CNNVDid:CNNVD-201810-1093
Trust: 0.7
db:AUSCERTid:ESB-2019.2408
Trust: 0.6
db:VULHUBid:VHN-125562
Trust: 0.1
sources:
            
            
            VULHUB: VHN-125562 // 
            
            
            
            JVNDB: JVNDB-2018-011232 // 
            
            
            
            CNNVD: CNNVD-201810-1093 // 
            
            
            
            NVD: CVE-2018-15315

REFERENCES
url:https://support.f5.com/csp/article/k41704442
Trust: 1.1
url:http://www.securitytracker.com/id/1041935
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15315
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-15315
Trust: 0.8
url:https://support.f5.com/csp/article/k44885536
Trust: 0.6
url:https://support.f5.com/csp/article/k20445457
Trust: 0.6
url:https://support.f5.com/csp/article/k67825238
Trust: 0.6
url:https://support.f5.com/csp/article/k79902360
Trust: 0.6
url:https://support.f5.com/csp/article/k20541896
Trust: 0.6
url:https://support.f5.com/csp/article/k22384173
Trust: 0.6
url:https://support.f5.com/csp/article/k29149494
Trust: 0.6
url:https://support.f5.com/csp/article/k68151373
Trust: 0.6
url:https://support.f5.com/csp/article/k00432398
Trust: 0.6
url:https://support.f5.com/csp/article/k64855220
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2408/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-125562 // 
            
            
            
            JVNDB: JVNDB-2018-011232 // 
            
            
            
            CNNVD: CNNVD-201810-1093 // 
            
            
            
            NVD: CVE-2018-15315

SOURCES
db:VULHUBid:VHN-125562
db:JVNDBid:JVNDB-2018-011232
db:CNNVDid:CNNVD-201810-1093
db:NVDid:CVE-2018-15315

LAST UPDATE DATE
2024-11-23T21:38:13.041000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-125562date:2018-12-04T00:00:00
db:JVNDBid:JVNDB-2018-011232date:2019-01-09T00:00:00
db:CNNVDid:CNNVD-201810-1093date:2020-07-07T00:00:00
db:NVDid:CVE-2018-15315date:2024-11-21T03:50:32.547

SOURCES RELEASE DATE
db:VULHUBid:VHN-125562date:2018-10-19T00:00:00
db:JVNDBid:JVNDB-2018-011232date:2019-01-09T00:00:00
db:CNNVDid:CNNVD-201810-1093date:2018-10-22T00:00:00
db:NVDid:CVE-2018-15315date:2018-10-19T13:29:00.493