F5 BIG-IP APM Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in BIG-IP APM versions 15.1.0 through 15.1.10, 16.1.0 through 16.1.6, and 17.1.0 through 17.1.2. This vulnerability allows an attacker to execute JavaScript in the context of a targeted logged-out user by sending a crafted URL that is reflected back and executed by the user's web browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute JavaScript in the context of the affected user.

Remediation

Users can upgrade to BIG-IP APM versions 17.5.1.3 or 16.1.6.1 to address this vulnerability. For those on the 15.x branch, version 15.1.10.8 is available. Consult the F5 BIG-IP hotfix and point release matrix for more details.