{"vuid":"VU#143395","idnumber":"143395","name":"F5 Networks ASM appliance contains a cross-site scripting vulnerability","keywords":["F5","xss","asm","cwe-79"],"overview":"F5 Networks ASM appliance versions 10.0.0 through 11.2.0 HF2 are susceptible to a cross-site scripting vulnerability in the traffic overview page.","clean_desc":"A cross-site scripting (XSS) (CWE-79) vulnerability exists in the traffic overview page. By sending several malicious requests, an attacker may be able to have the requests propagate to the summary listings page where proper sanitization is not performed.","impact":"An attacker may be able to execute arbitrary script in the context of an authenticated user's session.","resolution":"Apply an Update Vendor patches (Portal authentication required) are available for supported versions.","workarounds":"","sysaffected":"","thanks":"Thanks to F5 Networks for reporting this vulnerability.","author":"This document was written by Jared Allar.","public":["http://www.f5.com/products/big-ip/big-ip-application-security-manager/overview","https://support.f5.com/kb/en-us/solutions/public/13000/800/sol13838.html","http://cwe.mitre.org/data/definitions/79.html"],"cveids":["CVE-2012-2975"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2012-07-12T13:38:43Z","publicdate":"2012-09-10T00:00:00Z","datefirstpublished":"2012-09-10T15:53:52Z","dateupdated":"2012-09-10T16:46:08Z","revision":17,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"M","cvss_authentication":null,"cvss_confidentialityimpact":"N","cvss_integrityimpact":"P","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"ND","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"4.3","cvss_basevector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","cvss_temporalscore":"3.4","cvss_environmentalscore":"3.4","cvss_environmentalvector":"CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}