F5 Networks BIG-IP Application Security Manager (ASM) Cross-Site Scripting Vulnerability

Bugtraq ID:	55486
Class:	Input Validation Error
CVE:	CVE-2012-2975
Remote:	Yes
Local:	No
Published:	Sep 10 2012 12:00AM
Updated:	Mar 19 2015 09:28AM
Credit:	Reported by the vendor
Vulnerable:
Not Vulnerable:

F5 Networks BIG-IP Application Security Manager (ASM) Cross-Site Scripting Vulnerability

F5 Networks BIG-IP Application Security Manager (ASM) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

BIG-IP ASM versions 10.0.0 through 11.2.0 HF2 are vulnerable.

F5 Networks BIG-IP Application Security Manager (ASM) Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

F5 Networks BIG-IP Application Security Manager (ASM) Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.

F5 Networks BIG-IP Application Security Manager (ASM) Cross-Site Scripting Vulnerability

References: