First published: Thu May 05 2022(Updated: )
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Credit: f5sirt@f5.com
Affected Software | Affected Version | How to fix |
---|---|---|
F5 BIG-IP Access Policy Manager | =13.1.0 | |
F5 BIG-IP Access Policy Manager | =13.1.1 | |
F5 BIG-IP Access Policy Manager | =13.1.3 | |
F5 BIG-IP Access Policy Manager | =13.1.4 | |
F5 BIG-IP Access Policy Manager | =13.1.5 | |
F5 BIG-IP Access Policy Manager | =14.1.0 | |
F5 BIG-IP Access Policy Manager | =14.1.2 | |
F5 BIG-IP Access Policy Manager | =14.1.3 | |
F5 BIG-IP Access Policy Manager | =14.1.4 | |
F5 BIG-IP Access Policy Manager | =15.1.0 | |
F5 BIG-IP Access Policy Manager | =15.1.1 | |
F5 BIG-IP Access Policy Manager | =15.1.2 | |
F5 BIG-IP Access Policy Manager | =15.1.3 | |
F5 BIG-IP Access Policy Manager | =15.1.4 | |
F5 BIG-IP Access Policy Manager | =15.1.5 | |
F5 BIG-IP Access Policy Manager | =16.1.0 | |
F5 BIG-IP Access Policy Manager | =16.1.1 | |
F5 BIG-IP Access Policy Manager | =16.1.2 | |
F5 BIG-IP Advanced Firewall Manager | =13.1.0 | |
F5 BIG-IP Advanced Firewall Manager | =13.1.1 | |
F5 BIG-IP Advanced Firewall Manager | =13.1.3 | |
F5 BIG-IP Advanced Firewall Manager | =13.1.4 | |
F5 BIG-IP Advanced Firewall Manager | =13.1.5 | |
F5 BIG-IP Advanced Firewall Manager | =14.1.0 | |
F5 BIG-IP Advanced Firewall Manager | =14.1.2 | |
F5 BIG-IP Advanced Firewall Manager | =14.1.3 | |
F5 BIG-IP Advanced Firewall Manager | =14.1.4 | |
F5 BIG-IP Advanced Firewall Manager | =15.1.0 | |
F5 BIG-IP Advanced Firewall Manager | =15.1.1 | |
F5 BIG-IP Advanced Firewall Manager | =15.1.2 | |
F5 BIG-IP Advanced Firewall Manager | =15.1.3 | |
F5 BIG-IP Advanced Firewall Manager | =15.1.4 | |
F5 BIG-IP Advanced Firewall Manager | =15.1.5 | |
F5 BIG-IP Advanced Firewall Manager | =16.1.0 | |
F5 BIG-IP Advanced Firewall Manager | =16.1.1 | |
F5 BIG-IP Advanced Firewall Manager | =16.1.2 | |
F5 BIG-IP Analytics | =13.1.0 | |
F5 BIG-IP Analytics | =13.1.1 | |
F5 BIG-IP Analytics | =13.1.3 | |
F5 BIG-IP Analytics | =13.1.4 | |
F5 BIG-IP Analytics | =13.1.5 | |
F5 BIG-IP Analytics | =14.1.0 | |
F5 BIG-IP Analytics | =14.1.2 | |
F5 BIG-IP Analytics | =14.1.3 | |
F5 BIG-IP Analytics | =14.1.4 | |
F5 BIG-IP Analytics | =15.1.0 | |
F5 BIG-IP Analytics | =15.1.1 | |
F5 BIG-IP Analytics | =15.1.2 | |
F5 BIG-IP Analytics | =15.1.3 | |
F5 BIG-IP Analytics | =15.1.4 | |
F5 BIG-IP Analytics | =15.1.5 | |
F5 BIG-IP Analytics | =16.1.0 | |
F5 BIG-IP Analytics | =16.1.1 | |
F5 BIG-IP Analytics | =16.1.2 | |
f5 big-ip application acceleration manager | =13.1.0 | |
f5 big-ip application acceleration manager | =13.1.1 | |
f5 big-ip application acceleration manager | =13.1.3 | |
f5 big-ip application acceleration manager | =13.1.4 | |
f5 big-ip application acceleration manager | =13.1.5 | |
f5 big-ip application acceleration manager | =14.1.0 | |
f5 big-ip application acceleration manager | =14.1.2 | |
f5 big-ip application acceleration manager | =14.1.3 | |
f5 big-ip application acceleration manager | =14.1.4 | |
f5 big-ip application acceleration manager | =15.1.0 | |
f5 big-ip application acceleration manager | =15.1.1 | |
f5 big-ip application acceleration manager | =15.1.2 | |
f5 big-ip application acceleration manager | =15.1.3 | |
f5 big-ip application acceleration manager | =15.1.4 | |
f5 big-ip application acceleration manager | =15.1.5 | |
f5 big-ip application acceleration manager | =16.1.0 | |
f5 big-ip application acceleration manager | =16.1.1 | |
f5 big-ip application acceleration manager | =16.1.2 | |
F5 BIG-IP Application Security Manager | =13.1.0 | |
F5 BIG-IP Application Security Manager | =13.1.1 | |
F5 BIG-IP Application Security Manager | =13.1.3 | |
F5 BIG-IP Application Security Manager | =13.1.4 | |
F5 BIG-IP Application Security Manager | =13.1.5 | |
F5 BIG-IP Application Security Manager | =14.1.0 | |
F5 BIG-IP Application Security Manager | =14.1.2 | |
F5 BIG-IP Application Security Manager | =14.1.3 | |
F5 BIG-IP Application Security Manager | =14.1.4 | |
F5 BIG-IP Application Security Manager | =15.1.0 | |
F5 BIG-IP Application Security Manager | =15.1.1 | |
F5 BIG-IP Application Security Manager | =15.1.2 | |
F5 BIG-IP Application Security Manager | =15.1.3 | |
F5 BIG-IP Application Security Manager | =15.1.4 | |
F5 BIG-IP Application Security Manager | =15.1.5 | |
F5 BIG-IP Application Security Manager | =16.1.0 | |
F5 BIG-IP Application Security Manager | =16.1.1 | |
F5 BIG-IP Application Security Manager | =16.1.2 | |
f5 big-ip domain name system | =13.1.0 | |
f5 big-ip domain name system | =13.1.1 | |
f5 big-ip domain name system | =13.1.3 | |
f5 big-ip domain name system | =13.1.4 | |
f5 big-ip domain name system | =13.1.5 | |
f5 big-ip domain name system | =14.1.0 | |
f5 big-ip domain name system | =14.1.2 | |
f5 big-ip domain name system | =14.1.3 | |
f5 big-ip domain name system | =14.1.4 | |
f5 big-ip domain name system | =15.1.0 | |
f5 big-ip domain name system | =15.1.1 | |
f5 big-ip domain name system | =15.1.2 | |
f5 big-ip domain name system | =15.1.3 | |
f5 big-ip domain name system | =15.1.4 | |
f5 big-ip domain name system | =15.1.5 | |
f5 big-ip domain name system | =16.1.0 | |
f5 big-ip domain name system | =16.1.1 | |
f5 big-ip domain name system | =16.1.2 | |
f5 big-ip fraud protection service | =13.1.0 | |
f5 big-ip fraud protection service | =13.1.1 | |
f5 big-ip fraud protection service | =13.1.3 | |
f5 big-ip fraud protection service | =13.1.4 | |
f5 big-ip fraud protection service | =13.1.5 | |
f5 big-ip fraud protection service | =14.1.0 | |
f5 big-ip fraud protection service | =14.1.2 | |
f5 big-ip fraud protection service | =14.1.3 | |
f5 big-ip fraud protection service | =14.1.4 | |
f5 big-ip fraud protection service | =15.1.0 | |
f5 big-ip fraud protection service | =15.1.1 | |
f5 big-ip fraud protection service | =15.1.2 | |
f5 big-ip fraud protection service | =15.1.3 | |
f5 big-ip fraud protection service | =15.1.4 | |
f5 big-ip fraud protection service | =15.1.5 | |
f5 big-ip fraud protection service | =16.1.0 | |
f5 big-ip fraud protection service | =16.1.1 | |
f5 big-ip fraud protection service | =16.1.2 | |
F5 BIG-IP Global Traffic Manager | =13.1.0 | |
F5 BIG-IP Global Traffic Manager | =13.1.1 | |
F5 BIG-IP Global Traffic Manager | =13.1.3 | |
F5 BIG-IP Global Traffic Manager | =13.1.4 | |
F5 BIG-IP Global Traffic Manager | =13.1.5 | |
F5 BIG-IP Global Traffic Manager | =14.1.0 | |
F5 BIG-IP Global Traffic Manager | =14.1.2 | |
F5 BIG-IP Global Traffic Manager | =14.1.3 | |
F5 BIG-IP Global Traffic Manager | =14.1.4 | |
F5 BIG-IP Global Traffic Manager | =15.1.0 | |
F5 BIG-IP Global Traffic Manager | =15.1.1 | |
F5 BIG-IP Global Traffic Manager | =15.1.2 | |
F5 BIG-IP Global Traffic Manager | =15.1.3 | |
F5 BIG-IP Global Traffic Manager | =15.1.4 | |
F5 BIG-IP Global Traffic Manager | =15.1.5 | |
F5 BIG-IP Global Traffic Manager | =16.1.0 | |
F5 BIG-IP Global Traffic Manager | =16.1.1 | |
F5 BIG-IP Global Traffic Manager | =16.1.2 | |
f5 big-ip link controller | =13.1.0 | |
f5 big-ip link controller | =13.1.1 | |
f5 big-ip link controller | =13.1.3 | |
f5 big-ip link controller | =13.1.4 | |
f5 big-ip link controller | =13.1.5 | |
f5 big-ip link controller | =14.1.0 | |
f5 big-ip link controller | =14.1.2 | |
f5 big-ip link controller | =14.1.3 | |
f5 big-ip link controller | =14.1.4 | |
f5 big-ip link controller | =15.1.0 | |
f5 big-ip link controller | =15.1.1 | |
f5 big-ip link controller | =15.1.2 | |
f5 big-ip link controller | =15.1.3 | |
f5 big-ip link controller | =15.1.4 | |
f5 big-ip link controller | =15.1.5 | |
f5 big-ip link controller | =16.1.0 | |
f5 big-ip link controller | =16.1.1 | |
f5 big-ip link controller | =16.1.2 | |
F5 BIG-IP Local Traffic Manager | =13.1.0 | |
F5 BIG-IP Local Traffic Manager | =13.1.1 | |
F5 BIG-IP Local Traffic Manager | =13.1.3 | |
F5 BIG-IP Local Traffic Manager | =13.1.4 | |
F5 BIG-IP Local Traffic Manager | =13.1.5 | |
F5 BIG-IP Local Traffic Manager | =14.1.0 | |
F5 BIG-IP Local Traffic Manager | =14.1.2 | |
F5 BIG-IP Local Traffic Manager | =14.1.3 | |
F5 BIG-IP Local Traffic Manager | =14.1.4 | |
F5 BIG-IP Local Traffic Manager | =15.1.0 | |
F5 BIG-IP Local Traffic Manager | =15.1.1 | |
F5 BIG-IP Local Traffic Manager | =15.1.2 | |
F5 BIG-IP Local Traffic Manager | =15.1.3 | |
F5 BIG-IP Local Traffic Manager | =15.1.4 | |
F5 BIG-IP Local Traffic Manager | =15.1.5 | |
F5 BIG-IP Local Traffic Manager | =16.1.0 | |
F5 BIG-IP Local Traffic Manager | =16.1.1 | |
F5 BIG-IP Local Traffic Manager | =16.1.2 | |
F5 BIG-IP Policy Enforcement Manager | =13.1.0 | |
F5 BIG-IP Policy Enforcement Manager | =13.1.1 | |
F5 BIG-IP Policy Enforcement Manager | =13.1.3 | |
F5 BIG-IP Policy Enforcement Manager | =13.1.4 | |
F5 BIG-IP Policy Enforcement Manager | =13.1.5 | |
F5 BIG-IP Policy Enforcement Manager | =14.1.0 | |
F5 BIG-IP Policy Enforcement Manager | =14.1.2 | |
F5 BIG-IP Policy Enforcement Manager | =14.1.3 | |
F5 BIG-IP Policy Enforcement Manager | =14.1.4 | |
F5 BIG-IP Policy Enforcement Manager | =15.1.0 | |
F5 BIG-IP Policy Enforcement Manager | =15.1.1 | |
F5 BIG-IP Policy Enforcement Manager | =15.1.2 | |
F5 BIG-IP Policy Enforcement Manager | =15.1.3 | |
F5 BIG-IP Policy Enforcement Manager | =15.1.4 | |
F5 BIG-IP Policy Enforcement Manager | =15.1.5 | |
F5 BIG-IP Policy Enforcement Manager | =16.1.0 | |
F5 BIG-IP Policy Enforcement Manager | =16.1.1 | |
F5 BIG-IP Policy Enforcement Manager | =16.1.2 | |
F5 BIG-IP Guided Configuration | =6.0 | |
F5 BIG-IP Guided Configuration | =7.0 | |
F5 BIG-IP Guided Configuration | =8.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-27878 has been rated as a medium severity vulnerability due to the potential for stored cross-site scripting (XSS).
To fix CVE-2022-27878, it is recommended to upgrade to F5 BIG-IP versions that address the vulnerability as detailed in the support documentation.
CVE-2022-27878 affects various versions of F5 BIG-IP, including 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, 11.6.x, and F5 BIG-IP Guided Configuration versions prior to 9.0.
Stored cross-site scripting (XSS) allows an attacker to inject malicious scripts that are then stored on the server and executed in the context of users' browsers.
To mitigate the risks of CVE-2022-27878, users should apply the recommended patches and adopt secure coding practices to filter user inputs.