CVE-2018-15312: XSS

Q: What is the severity of CVE-2018-15312?

The severity of CVE-2018-15312 is classified as high due to the potential for reflected Cross-Site Scripting attacks.

Q: How do I fix CVE-2018-15312?

To mitigate CVE-2018-15312, apply the recommended patches provided by F5 for affected versions of BIG-IP.

Q: Who is affected by CVE-2018-15312?

CVE-2018-15312 affects F5 BIG-IP versions 12.1.0-12.1.3.6 and 13.0.0-13.1.1.1.

Q: What types of attacks can CVE-2018-15312 enable?

CVE-2018-15312 can enable attackers to execute arbitrary JavaScript code in the context of the logged-in user's session.

Q: Is user authentication required to exploit CVE-2018-15312?

Yes, CVE-2018-15312 requires an authenticated user to exploit the reflected Cross-Site Scripting vulnerability.

Published Oct 19, 2018

Updated

On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an authenticated user to execute JavaScript for the currently logged-in user.

Affected Software

26 affected components

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.3.6

F5 Big-ip Application Acceleration Manager>=13.0.0<=13.1.1.1

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.3.6

F5 Big-ip Local Traffic Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.3.6

F5 BIG-IP Advanced Firewall Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Analytics>=12.1.0<=12.1.3.6

F5 BIG-IP Analytics>=13.0.0<=13.1.1.1

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.3.6

F5 BIG-IP Access Policy Manager>=13.0.0<=13.1.1.1

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.3.6

F5 BIG-IP Application Security Manager>=13.0.0<=13.1.1.1

F5 Big-ip Domain Name System>=12.1.0<=12.1.3.6

F5 Big-ip Domain Name System>=13.0.0<=13.1.1.1

F5 BIG-IP Edge Gateway>=12.1.0<=12.1.3.6

F5 BIG-IP Edge Gateway>=13.0.0<=13.1.1.1

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.3.6

F5 Big-ip Fraud Protection Service>=13.0.0<=13.1.1.1

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.3.6

F5 Big-ip Global Traffic Manager>=13.0.0<=13.1.1.1

F5 Big-ip Link Controller>=12.1.0<=12.1.3.6

F5 Big-ip Link Controller>=13.0.0<=13.1.1.1

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.3.6

F5 Big-ip Policy Enforcement Manager>=13.0.0<=13.1.1.1

F5 Big-ip Webaccelerator>=12.1.0<=12.1.3.6

F5 Big-ip Webaccelerator>=13.0.0<=13.1.1.1

Event History

Oct 19, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-15312?

The severity of CVE-2018-15312 is classified as high due to the potential for reflected Cross-Site Scripting attacks.

How do I fix CVE-2018-15312?

To mitigate CVE-2018-15312, apply the recommended patches provided by F5 for affected versions of BIG-IP.

Who is affected by CVE-2018-15312?