XSS in F5 Big-Ip Access Policy Manager
CVE-2013-5976
Cross-site scripting (XSS) vulnerability in the access policy logout page (logout.inc) in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.1.0 through 11.3.0 allows remote attackers to inject arbitrary web script or HTML via the LastMRH_Session cookie.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.018 (76.3th percentile) — read the EPSS interpretation.
Affected products
- F5 Big-ip_access_policy_manager — versions 10.1.0, 10.2.4, 11.0.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)