CVE-2022-27230: f5 big-ip_access_policy_manager Cross-site Scripting
Vulnerability summary
CVE-2022-27230 is a high (CVSS 7.5) Cross-site Scripting vulnerability in f5 big-ip_access_policy_manager. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44% of scored vulnerabilities.
Timeline
- 05-05-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP APM, and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of F5 BIG-IP Guided Configuration that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.01 pp
From 0.53% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
F54 products
- big-ip_access_policy_manager13.1.0 | 13.1.1 | 13.1.3 | 13.1.4 | 13.1.5 | 14.1.0 | 14.1.2 | 14.1.3 | 14.1.4 | 15.1.0 | 15.1.1 | 15.1.2 | 15.1.3 | 15.1.4 | 15.1.5 | 16.1.0 | 16.1.1 | 16.1.2
- big-ip_apm≥ 16.1.0, < 16.2.0 | ≥ 15.1.0, < 15.2.0 | ≥ 14.1.0, < 14.2.0 | ≥ 13.1.0, < 13.2.0 | ≥ 12.1.0, < 12.2.0 | ≥ 11.6.0, < 11.7.0
- big-ip_guided_configuration< 9.0
- big-ip guided configuration (gc)≥ All, < 9.0
1 vendor · 4 products