| Package | Affected versions | Patched versions |
|---|---|---|
| big-ip access policy manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip advanced firewall manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip analytics | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip application acceleration manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip application security manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip domain name system | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip edge gateway | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip fraud protection service | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip global traffic manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip link controller | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip local traffic manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip policy enforcement manager | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 | |
| big-ip webaccelerator | ≥ 11.5.1, ≤ 11.5.8≥ 11.6.1, ≤ 11.6.3.2≥ 12.1.0, ≤ 12.1.3.7≥ 13.0.0, ≤ 13.1.1.3≥ 14.0.0, ≤ 14.0.0.2 |
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free