A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages
Impact:
An attacker may trick authenticated BIG-IP users
into accessing malicious links and reflect a spoofed error message in
the victim's BIG-IP Configuration utility web browser session. This is a
control plane issue; there is no data plane exposure.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
f5 / big-ip_access_policy_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_advanced_firewall_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_advanced_web_application_firewall ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_analytics ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_application_acceleration_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_application_security_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_application_visibility_and_reporting ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_automation_toolchain ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_carrier-grade_nat ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_container_ingress_services ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_ddos_hybrid_defender ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_domain_name_system ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_edge_gateway ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_fraud_protection_service ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_global_traffic_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_link_controller ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_local_traffic_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_policy_enforcement_manager ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_ssl_orchestrator ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_webaccelerator ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
f5 / big-ip_websafe ≥17.1.0 ≤17.1.3, ≥17.5.0 ≤17.5.1, ≥21.0.0 ≤21.1.0
