CVE-2023-38423
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
CVE-2023-38423 describes a cross-site scripting (XSS) vulnerability in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
Risk Assessment
This vulnerability could lead to session hijacking or data theft, posing a significant security risk to the organization.
Recommendation
It is recommended to update the software to the latest version that has not reached End of Technical Support to minimize the risk associated with this vulnerability.
Other vulnerabilities in BIG-IP Configuration utility
See all- CVE-2023-46748HighActively exploited
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility. It may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.
- CVE-2026-40703Medium
A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility. This affects software versions that have not reached End of Technical Support (EoTS).
- CVE-2023-38138High
A reflected XSS vulnerability exists in the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.