Vulnerability · Published Sep 14, 2021 · Assigned by f5
CVE-2021-23041
Medium 6.1
In plain English
A medium-severity cross-site scripting in BIG-IP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products (as reported)
Weakness: CWE-79
References
- https://support.f5.com/csp/article/K42526507 x_refsource_MISC