CVE-2023-38423
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
CVE-2023-38423 describes a cross-site scripting (XSS) vulnerability in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.
Risk Assessment
This vulnerability could lead to session hijacking or data theft, posing a significant security risk to the organization.
Recommendation
It is recommended to update the software to the latest version that has not reached End of Technical Support to minimize the risk associated with this vulnerability.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.