Sign-up

ID

VAR-201810-0911


CVE

CVE-2018-15315


TITLE

F5 BIG-IP Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2018-011232

DESCRIPTION

On F5 BIG-IP 13.0.0-13.1.1.1 and 12.1.0-12.1.3.6, there is a reflected Cross Site Scripting (XSS) vulnerability in an undisclosed Configuration Utility page. F5 BIG-IP Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Trust: 1.71

sources: NVD: CVE-2018-15315 // JVNDB: JVNDB-2018-011232 // VULHUB: VHN-125562

AFFECTED PRODUCTS

vendor:f5model:big-ip application security managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.1.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:12.1.3.6

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.1

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip policy enforcement managerscope:eqversion:13.1.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.0

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.2

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:12.1.3

Trust: 0.6

vendor:f5model:big-ip webacceleratorscope:eqversion:13.0.1

Trust: 0.6

sources: CNNVD: CNNVD-201810-1093 // JVNDB: JVNDB-2018-011232 // NVD: CVE-2018-15315

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15315
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-15315
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201810-1093
value: MEDIUM

Trust: 0.6

VULHUB: VHN-125562
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-15315
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125562
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15315
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125562 // CNNVD: CNNVD-201810-1093 // JVNDB: JVNDB-2018-011232 // NVD: CVE-2018-15315

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-125562 // JVNDB: JVNDB-2018-011232 // NVD: CVE-2018-15315

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1093

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201810-1093

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-011232

PATCH
title:K41704442url:https://support.f5.com/csp/article/K41704442
Trust: 0.8
title:F5 BIG-IP Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86219
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201810-1093 // 
            
            
            
            JVNDB: JVNDB-2018-011232

EXTERNAL IDS
db:NVDid:CVE-2018-15315
Trust: 2.5
db:SECTRACKid:1041935
Trust: 1.1
db:JVNDBid:JVNDB-2018-011232
Trust: 0.8
db:CNNVDid:CNNVD-201810-1093
Trust: 0.7
db:AUSCERTid:ESB-2019.2408
Trust: 0.6
db:VULHUBid:VHN-125562
Trust: 0.1
sources:
            
            
            VULHUB: VHN-125562 // 
            
            
            
            CNNVD: CNNVD-201810-1093 // 
            
            
            
            JVNDB: JVNDB-2018-011232 // 
            
            
            
            NVD: CVE-2018-15315

REFERENCES
url:https://support.f5.com/csp/article/k41704442
Trust: 1.1
url:http://www.securitytracker.com/id/1041935
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15315
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-15315
Trust: 0.8
url:https://support.f5.com/csp/article/k44885536
Trust: 0.6
url:https://support.f5.com/csp/article/k20445457
Trust: 0.6
url:https://support.f5.com/csp/article/k67825238
Trust: 0.6
url:https://support.f5.com/csp/article/k79902360
Trust: 0.6
url:https://support.f5.com/csp/article/k20541896
Trust: 0.6
url:https://support.f5.com/csp/article/k22384173
Trust: 0.6
url:https://support.f5.com/csp/article/k29149494
Trust: 0.6
url:https://support.f5.com/csp/article/k68151373
Trust: 0.6
url:https://support.f5.com/csp/article/k00432398
Trust: 0.6
url:https://support.f5.com/csp/article/k64855220
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.2408/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-125562 // 
            
            
            
            CNNVD: CNNVD-201810-1093 // 
            
            
            
            JVNDB: JVNDB-2018-011232 // 
            
            
            
            NVD: CVE-2018-15315

SOURCES
db:VULHUBid:VHN-125562
db:CNNVDid:CNNVD-201810-1093
db:JVNDBid:JVNDB-2018-011232
db:NVDid:CVE-2018-15315

LAST UPDATE DATE
2026-06-19T22:34:49.970000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-125562date:2018-12-04T00:00:00
db:CNNVDid:CNNVD-201810-1093date:2020-07-07T00:00:00
db:JVNDBid:JVNDB-2018-011232date:2019-01-09T00:00:00
db:NVDid:CVE-2018-15315date:2026-06-17T01:42:14.743

SOURCES RELEASE DATE
db:VULHUBid:VHN-125562date:2018-10-19T00:00:00
db:CNNVDid:CNNVD-201810-1093date:2018-10-22T00:00:00
db:JVNDBid:JVNDB-2018-011232date:2019-01-09T00:00:00
db:NVDid:CVE-2018-15315date:2018-10-19T13:29:00.493