Description
Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter.
References
- 35418 third-party-advisory
- 35426 third-party-advisory
- https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106
- 55040 vdb-entry
- https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf
- 20090611 F5 FirePass Cross-Site Scripting vulnerability mailing-list
- 35312 vdb-entry
- firepasssslvpn-unspecified-xss(51064) vdb-entry
- ADV-2009-1570 vdb-entry
- 1022387 vdb-entry