CVE-2007-0186 Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (...
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho parameter to my.logon.php3; the (2) topblue, (3) midblue, (4) wtopblue, and certain other Custom color parameters in a per action to vdesk/admincon/index.php; the (5) h321, (6) h311, (7) h312, and certain other Front Door custom text color parameters in a per action to vdesk/admincon/index.php; the (8) ua parameter in a bro action to vdesk/admincon/index.php; the (9) app_param and (10) app_name parameters to webyfiers.php; (11) double eval functions; (12) JavaScript contained in an <FP_DO_NOT_TOUCH> element; and (13) the vhost parameter to my.activation.php. NOTE: it is possible that this candidate overlaps CVE-2006-3550.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 firepass 4100 | All versions | No fix listed |
References
- 20070106 NNL-Labs & MNIN - F5 FirePass Security Advisory mailing-list
- 23627 third-party-advisory
- 23643 third-party-advisory
- www.mnin.org
- 32737 vdb-entry
- 32738 vdb-entry
- 32739 vdb-entry
- 32740 vdb-entry
- 32741 vdb-entry
- 32742 vdb-entry
- 32743 vdb-entry
- 21957 vdb-entry
- tech.f5.com
- tech.f5.com