CVE-2024-47139

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)

Published: Oct 16, 2024 / Updated: 34d ago

In the constantly changing world of cybersecurity, keeping abreast of vulnerabilities is essential for preserving the integrity of your systems. Recently, F5 has disclosed two significant vulnerabilities: CVE-2024-47139, related to BIG-IQ and CVE-2024-45844 affecting BIG-IP. This blog post will go into the details of these vulnerabilities, their potential impact, and how organizations can assess their […] The post F5 fixed a high-severity elevation of privilege vulnerability in BIG-IP appeared first on SecPod Blog .

Attackers with at least "manager" privileges could leverage the BIG-IP vulnerability, tracked as CVE-2024-45844, to facilitate privilege escalation and systems compromise.

... OT Security · CRA News Service October 2, 2024. Dragos' acquisition of Network Perception will enable more robust OT security services. Privacy ...

The advisory states, “This vulnerability may allow an authenticated attacker with Manager role privileges or greater, with access to the Configuration utility or TMOS Shell (tmsh), to elevate their privileges and compromise the BIG-IP system. The vulnerability CVE-2024-45844 allows an authenticated attacker, with Manager role privileges or more, to exploit it and elevate their privileges, thereby compromising the BIG-IP system.

“This vulnerability may allow an authenticated attacker with Manager role privileges or greater, with access to the Configuration utility or TMOS Shell ( tmsh ), to elevate their privileges and compromise the BIG-IP system. To mitigate the issue, organizations should restrict access to the BIG-IP configuration utility and SSH to trusted networks or devices, and block access via self IP addresses.