CVE-2023-38138
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A reflected XSS vulnerability exists in the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
Risk Assessment
An attacker could exploit this vulnerability to hijack user sessions or steal data, posing a significant security risk to the organization.
Recommendation
It is recommended to update the software to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in BIG-IP Configuration utility
See all- CVE-2026-40703Medium
A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. This affects software versions that have not reached End of Technical Support (EoTS).
- CVE-2023-38423Medium
CVE-2023-38423 describes a cross-site scripting (XSS) vulnerability in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.