Vulnerability · Published May 5, 2022 · Assigned by f5

CVE-2022-27230

High 7.5

In plain English

A high-severity cross-site scripting in BIG-IP APM from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of F5 BIG-IP Guided Configuration that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products (as reported)

Vendor	Product	Versions
F5	BIG-IP APM	16.1.x15.1.x14.1.x13.1.x12.1.x11.6.x
F5	BIG-IP Guided Configuration (GC)	All – before 9.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://support.f5.com/csp/article/K21317311 x_refsource_MISC