Vulnerability CVE-2016-7469 - CERT Civis.Net

Vulnerability Name:

CVE-2016-7469 (CCN-120359)

Assigned:

2016-09-09

Published:

2017-01-07

Updated:

2019-06-06

Summary:

A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WOM and WebSafe version 12.0.0 - 12.1.2, 11.4.0 - 11.6.1, and 11.2.1 allows an authenticated user to inject arbitrary web script or HTML. Exploitation requires Resource Administrator or Administrator privileges, and it could cause the Configuration utility client to become unstable.

CVSS v3 Severity:

5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
4.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2016-7469

Source: CCN
Type: SECTRACK ID: 1037559
F5 Enterprise Manager Input Validation Flaw in Configuration Utility Lets Remote Users Conduct Cross-Site Scripting Attacks

Source: CCN
Type: SECTRACK ID: 1037560
F5 BIG-IP Input Validation Flaw in Configuration Utility Lets Remote Users Conduct Cross-Site Scripting Attacks

Source: CCN
Type: F5 Web site
Big-IP

Source: BID
Type: Third Party Advisory, VDB Entry
95320

Source: CCN
Type: BID-95320
Multiple F5 BIG-IP Products CVE-2016-7469 HTML Injection Vulnerability

Source: SECTRACK
Type: UNKNOWN
1037559

Source: SECTRACK
Type: UNKNOWN
1037560

Source: XF
Type: UNKNOWN
f5-bigip-cve20167469-xss(120359)

Source: CCN
Type: F5 Security Advisory K97285349
K97285349: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2016-7469

Source: CONFIRM
Type: Vendor Advisory
https://support.f5.com/csp/article/K97285349

Vulnerable Configuration:

Configuration 1:

cpe:/a:f5:big-ip_local_traffic_manager:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:f5:big-ip_application_acceleration_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:f5:big-ip_advanced_firewall_manager:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:f5:big-ip_analytics:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_analytics:12.1.2:*:*:*:*:*:*:*

Configuration 5:

cpe:/a:f5:big-ip_access_policy_manager:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*

Configuration 6:

cpe:/a:f5:big-ip_application_security_manager:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_application_security_manager:12.1.2:*:*:*:*:*:*:*

Configuration 7:

cpe:/a:f5:big-ip_domain_name_system:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_domain_name_system:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_domain_name_system:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_domain_name_system:12.1.2:*:*:*:*:*:*:*

Configuration 8:

cpe:/a:f5:big-ip_edge_gateway:11.2.1:*:*:*:*:*:*:*

Configuration 9:

cpe:/a:f5:big-ip_global_traffic_manager:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_global_traffic_manager:11.6.1:*:*:*:*:*:*:*

Configuration 10:

cpe:/a:f5:big-ip_link_controller:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_link_controller:12.1.2:*:*:*:*:*:*:*

Configuration 11:

cpe:/a:f5:big-ip_policy_enforcement_manager:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.4.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.2:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.3:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.5.4:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_policy_enforcement_manager:12.1.2:*:*:*:*:*:*:*

Configuration 12:

cpe:/a:f5:big-ip_protocol_security_module:11.4.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_protocol_security_module:11.4.1:*:*:*:*:*:*:*

Configuration 13:

cpe:/a:f5:big-ip_webaccelerator:11.2.1:*:*:*:*:*:*:*

Configuration 14:

cpe:/a:f5:big-ip_websafe:11.6.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_websafe:11.6.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_websafe:12.0.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_websafe:12.1.0:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_websafe:12.1.1:*:*:*:*:*:*:*

OR cpe:/a:f5:big-ip_websafe:12.1.2:*:*:*:*:*:*:*

Configuration 15:

cpe:/a:f5:big-ip_wan_optimization_manager:11.2.1:*:*:*:*:*:*:*

Configuration 16:

cpe:/a:f5:enterprise_manager:3.1.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:f5:big-ip:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:f5:enterprise_manager:*:*:*:*:*:*:*:*

Denotes that component is vulnerable