CVE-2019-8331: f5 big-ip_access_policy_manager

Modified

AliasesRHSA-2022:8848RHSA-2022:8865UBUNTU-CVE-2019-8331+2 more

Published 20-02-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-8331 is a medium (CVSS 6.1) vulnerability in f5 big-ip_access_policy_manager. EPSS estimates a 16.40% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (NVD)

EPSS score

16.40%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10

RHSA-2019:3023 RHSA-2019:3024 RHSA-2020:3247 RHSA-2020:3936 RHSA-2020:4670 RHSA-2020:4847+4 more

Timeline

20-02-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

CVSS metrics

9 scores · 8 sources · 3 versions

v3.16.1v3.06.1v2.04.3

EPSS trend

Probability

16.40%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 16.40% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

F513 products

big-ip_access_policy_manager≥ 12.1.0, < 12.1.5.1 | ≥ 13.0.0, < 13.1.3.4 | ≥ 14.0.0, < 14.1.2.5 | ≥ 15.0.0, < 15.1.0
big-ip_advanced_firewall_manager≥ 12.1.0, < 12.1.5.1 | ≥ 13.0.0, < 13.1.3.4 | ≥ 14.0.0, < 14.1.2.5 | ≥ 15.0.0, < 15.1.0
big-ip_analytics≥ 12.1.0, < 12.1.5.1 | ≥ 13.0.0, < 13.1.3.4 | ≥ 14.0.0, < 14.1.2.5 | ≥ 15.0.0, < 15.1.0
big-ip_application_acceleration_manager≥ 12.1.0, < 12.1.5.1 | ≥ 13.0.0, < 13.1.3.4 | ≥ 14.0.0, < 14.1.2.5 | ≥ 15.0.0, < 15.1.0
big-ip_application_security_manager≥ 12.1.0, < 12.1.5.1 | ≥ 13.0.0, < 13.1.3.4 | ≥ 14.0.0, < 14.1.2.5 | ≥ 15.0.0, < 15.1.0

Show all 13

Redhat4 products

virtualization_manager4.3
python-XStatic-Bootstrap-SCSS< 0:3.4.1.0-2.el8ost
python3-XStatic-Bootstrap-SCSS< 0:3.4.1.0-2.el8ost
xstatic-bootstrap-scss-common< 0:3.4.1.0-2.el8ost

NuGet3 products

bootstrap≥ 4.0.0, < 4.3.1 | ≥ 3.0.0, < 3.4.1
Bootstrap.Less≥ 3.0.0, < 3.4.1
bootstrap.sass< 4.3.1

RubyGems3 products

bootstrap< 4.3.1
bootstrap-sass≥ 3.0.0, < 3.4.1
twitter-bootstrap-rails< 5.3.0

Debian2 products

twitter-bootstrap3< 3.4.1+dfsg-1
twitter-bootstrap4< 4.3.1+dfsg2-1

Npm2 products

bootstrap≥ 4.0.0, < 4.3.1 | ≥ 3.0.0, < 3.4.1
bootstrap-sass≥ 3.0.0, < 3.4.1

Ubuntu2 products

twitter-bootstrapAll versions (No fix recorded)
twitter-bootstrap3All versions (No fix recorded)

Getbootstrap1 product

bootstrap< 3.4.1 | ≥ 4.3.0, < 4.3.1

Org.webjars1 product

bootstrap≥ 3.0.0, < 3.4.1 | ≥ 4.0.0, < 4.3.1

Tenable1 product

tenable.sc< 5.19.0

Twbs1 product

bootstrap≥ 3.0.0, < 3.4.1 | ≥ 4.0.0, < 4.3.1

11 vendors · 33 products

References

57 links

www.securityfocus.com/bid/107375VDB EntryX Refsource BIDThird Party Advisory
seclists.org/bugtraq/2019/May/18Mailing ListX Refsource BUGTRAQWEBThird Party Advisory
seclists.org/fulldisclosure/2019/May/11Mailing ListX Refsource FULLDISCWEBThird Party Advisory
seclists.org/fulldisclosure/2019/May/10Mailing ListX Refsource FULLDISCWEBThird Party Advisory
seclists.org/fulldisclosure/2019/May/13Mailing ListX Refsource FULLDISCWEBThird Party Advisory
access.redhat.com/errata/RHSA-2019:1456Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB

Show all 57 references

lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
access.redhat.com/errata/RHSA-2019:3023Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory
access.redhat.com/errata/RHSA-2019:3024Vendor AdvisoryX Refsource REDHATWEBThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.htmlX Refsource MISCWEBThird Party AdvisoryVDB Entry
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTWEB
www.oracle.com/security-alerts/cpuApr2021.htmlX Refsource MISCWEBThird Party Advisory
github.com/twbs/bootstrap/pull/28236X Refsource MISCREPORTWEBIssue TrackingPatchThird Party Advisory
github.com/twbs/bootstrap/releases/tag/v4.3.1X Refsource MISCREPORTWEBRelease NotesThird Party Advisory
blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/X Refsource CONFIRMVendor Advisory
github.com/twbs/bootstrap/releases/tag/v3.4.1X Refsource MISCWEBProductThird Party Advisory
support.f5.com/csp/article/K24383845X Refsource CONFIRMWEBThird Party Advisory
support.f5.com/csp/article/K24383845?utm_source=f5support&amp%3Butm_medium=RSSX Refsource CONFIRMWEB
www.tenable.com/security/tns-2021-14X Refsource CONFIRMWEBPatchThird Party Advisory
access.redhat.com/errata/RHSA-2022:8848Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1686454REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8848.jsonAdvisory
access.redhat.com/security/cve/CVE-2019-8331REPORT
www.cve.org/CVERecord?id=CVE-2019-8331AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2019-8331Advisory
access.redhat.com/errata/RHSA-2022:8865Advisory
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8865.jsonAdvisory
ubuntu.com/security/CVE-2019-8331REPORT
security-tracker.debian.org/tracker/CVE-2019-8331Advisory
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
support.f5.com/csp/article/K24383845?utm_source=f5support&utm_medium=RSSWEB
web.archive.org/web/20200227083900/http://www.securityfocus.com/bid/107375WEB
blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1WEB
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331WEB
github.com/advisories/GHSA-9v3m-8fp8-mj99Advisory
github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2019-8331.ymlWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/twitter-bootstrap-rails/CVE-2019-8331.ymlWEB
github.com/seyhunak/twitter-bootstrap-rails/tree/master/app/assets/javascripts/twitter/bootstrapWEB
github.com/twbs/bootstrapPACKAGE
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB
lists.apache.org/thread.html/…WEB