CVE-2024-27202 - Vulnerability Details - OpenCVE

A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.001.

Key SSVC decision points have not yet been added.

Vendors	Products
F5	Big-ip

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
F5	Big-ip

Advisories

Source	ID	Title
EUVD	EUVD-2024-24441	A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://my.f5.com/manage/s/article/K000138520

History

No history.

MITRE

Status: PUBLISHED

Assigner: f5

Published: 2024-05-08T15:01:26.004Z

Updated: 2024-08-02T00:27:59.644Z

Reserved: 2024-04-24T21:34:20.658Z

Link: CVE-2024-27202

Vulnrichment

Updated: 2024-08-02T00:27:59.644Z

NVD

Status : Awaiting Analysis

Published: 2024-05-08T15:15:08.980

Modified: 2024-11-21T09:04:05.373

Link: CVE-2024-27202

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-13T11:21:53Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27202", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2024-04-24T21:34:20.658Z", "datePublished": "2024-05-08T15:01:26.004Z", "dateUpdated": "2024-08-02T00:27:59.644Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["All Modules"], "product": "BIG-IP", "vendor": "F5", "versions": [{"lessThan": "17.1.1.3", "status": "affected", "version": "17.1.0", "versionType": "custom"}, {"lessThan": "16.1.4.3", "status": "affected", "version": "16.1.0", "versionType": "custom"}, {"lessThan": "15.1.10.4", "status": "affected", "version": "15.1.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "F5 acknowledges \u0141ukasz Rupala and Kajetan Rostojek from ING HUBS Poland for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2024-05-08T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.</span>  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "\nA DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2024-05-08T15:01:26.004Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://my.f5.com/manage/s/article/K000138520"}], "source": {"discovery": "EXTERNAL"}, "title": "BIG-IP TMUI XSS vulnerability", "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27202", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-09T15:54:16.208221Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"], "vendor": "f5", "product": "big-ip", "versions": [{"status": "affected", "version": "17.1.0, 16.1.0, 15.1.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:46:33.238Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.644Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://my.f5.com/manage/s/article/K000138520"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://my.f5.com/manage/s/article/K000138520", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.644Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27202", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-09T15:54:16.208221Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:f5:big-ip:-:*:*:*:*:*:*:*"], "vendor": "f5", "product": "big-ip", "versions": [{"status": "affected", "version": "17.1.0, 16.1.0, 15.1.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-09T15:54:04.246Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "BIG-IP TMUI XSS vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "F5 acknowledges \u0141ukasz Rupala and Kajetan Rostojek from ING HUBS Poland for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "F5", "modules": ["All Modules"], "product": "BIG-IP", "versions": [{"status": "affected", "version": "17.1.0", "lessThan": "17.1.1.3", "versionType": "custom"}, {"status": "affected", "version": "16.1.0", "lessThan": "16.1.4.3", "versionType": "custom"}, {"status": "affected", "version": "15.1.0", "lessThan": "15.1.10.4", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2024-05-08T14:00:00.000Z", "references": [{"url": "https://my.f5.com/manage/s/article/K000138520", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "F5 SIRTBot v1.0"}, "descriptions": [{"lang": "en", "value": "\nA DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.</span>  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2024-05-08T15:01:26.004Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27202", "state": "PUBLISHED", "dateUpdated": "2024-08-02T00:27:59.644Z", "dateReserved": "2024-04-24T21:34:20.658Z", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "datePublished": "2024-05-08T15:01:26.004Z", "assignerShortName": "f5"}, "dataVersion": "5.1"}