CVE-2016-9257: XSS
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9257?
CVE-2016-9257 has a high severity rating due to the potential for JavaScript injection by non-authenticated users.
How do I fix CVE-2016-9257?
To fix CVE-2016-9257, it is recommended to update F5 BIG-IP APM to the latest version provided by F5.
Which versions of F5 BIG-IP APM are affected by CVE-2016-9257?
F5 BIG-IP APM versions 12.0.0 through 12.1.2 are affected by CVE-2016-9257.
What are the potential impacts of CVE-2016-9257?
CVE-2016-9257 could lead to unauthorized script execution in contexts accessible to administrative users.
Who is at risk from CVE-2016-9257?
Organizations using the affected versions of F5 BIG-IP APM are at risk, especially if administrative users access the Access System Logs.