Total vulnerabilities in the database
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
| Software | From | Fixed in |
|---|---|---|
| f5 / big-ip_access_policy_manager | 12.1.2 | 12.1.2.x |
| f5 / big-ip_access_policy_manager | 12.0.0 | 12.0.0.x |
| f5 / big-ip_access_policy_manager | 12.1.1 | 12.1.1.x |
| f5 / big-ip_access_policy_manager | 12.1.0 | 12.1.0.x |