CVE-2007-6704

F5 FirePass 4100 SSL VPN <6.0.1 - XSS

Title source: llm

Description

Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Adrian Pastor · textremotehardware

https://www.exploit-db.com/exploits/30834

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Richard Brain · htmlremotehardware

https://www.exploit-db.com/exploits/30833

View Code ZIP pw:eip

References (15)

[Vendor Advisory] http://secunia.com/advisories/27904

[Various Sources] http://www.procheckup.com/Vulnerability_PR07-14.php

[Exploit] http://www.procheckup.com/Vulnerability_PR07-15a.php

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/38785

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/38795

[Vendor Advisory] https://support.f5.com/kb/en-us/solutions/public/7000/900/SOL7923.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/484411/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/484413/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/492511/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/26659

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/26661

[Third Party Advisory, VDB Entry] http://www.osvdb.org/38980

[Third Party Advisory, VDB Entry] http://www.osvdb.org/38981

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1019031

[Third Party Advisory] http://securityreason.com/securityalert/3712

Scores

EPSS 0.0708

EPSS Percentile 91.4%

Classification

CWE

CWE-79

Status draft

Affected Products (14)

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

f5/firepass_4100

Timeline

Published Mar 05, 2008

Tracked Since Feb 18, 2026