CVE-2014-3959: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Affected products

• F5 BIG-IP Access Policy Manager: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Advanced Firewall Manager: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Analytics: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Application Acceleration Manager: version 11.4.0 only; version 11.5.1 only
• F5 BIG-IP Application Security Manager: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Edge Gateway: version 11.2.1 only; version 11.3.0 only
• F5 BIG-IP Global Traffic Manager: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Link Controller: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Local Traffic Manager: version 11.2.1 only; version 11.5.1 only
• F5 BIG-IP Policy Enforcement Manager: version 11.3.0 only; version 11.5.1 only
• F5 BIG-IP Protocol Security Module: version 11.2.1 only; version 11.4.1 only
• F5 BIG-IP WAN Optimization Manager: version 11.2.1 only; version 11.3.0 only
• F5 BIG-IP Webaccelerator: version 11.2.1 only; version 11.3.0 only
• F5 Enterprise Manager: version 3.0.0 only; version 3.1.1 only

Published 2014-06-03. Last modified 2026-06-17.