CVE-2021-22978
HIGHBIG-IP 11.6.1-11.6.4 - Reflected Cross-Site Scripting via iControl REST Undisclosed Endpoints
Title source: llmDescription
On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://support.f5.com/csp/article/K87502622
Scores
CVSS v3
8.3
EPSS
0.0082
EPSS Percentile
74.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-79
Status
published
Products (14)
f5/big-ip_access_policy_manager
11.6.1 - 11.6.5
f5/big-ip_advanced_firewall_manager
11.6.1 - 11.6.5
f5/big-ip_advanced_web_application_firewall
11.6.1 - 11.6.5
f5/big-ip_analytics
11.6.1 - 11.6.5
f5/big-ip_application_acceleration_manager
11.6.1 - 11.6.5
f5/big-ip_application_security_manager
11.6.1 - 11.6.5
f5/big-ip_ddos_hybrid_defender
11.6.1 - 11.6.5
f5/big-ip_domain_name_system
11.6.1 - 11.6.5
f5/big-ip_fraud_protection_service
11.6.1 - 11.6.5
f5/big-ip_global_traffic_manager
11.6.1 - 11.6.5
... and 4 more
Published
Feb 12, 2021
Tracked Since
Feb 18, 2026