CVE-2016-9257
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
| Software | From | Fixed in |
|---|---|---|
| f5 / big-ip_access_policy_manager | 12.1.2 | 12.1.2.x |
| f5 / big-ip_access_policy_manager | 12.0.0 | 12.0.0.x |
| f5 / big-ip_access_policy_manager | 12.1.1 | 12.1.1.x |
| f5 / big-ip_access_policy_manager | 12.1.0 | 12.1.0.x |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime