CVE-2014-3959

Name: CVE-2014-3959
Creator: NVD / NIST
Published: 2014-06-03T14:55:11.49+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.55%

Last modified Jun 17, 2026

CVE-2014-3959 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.. EPSS estimates a 1.55% chance of exploitation in the next 30 days.

Description

Cross-site scripting (XSS) vulnerability in list.jsp in the Configuration utility in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, GTM, and Link Controller 11.2.1 through 11.5.1, AAM 11.4.0 through 11.5.1 PEM 11.3.0 through 11.5.1, PSM 11.2.1 through 11.4.1, WebAccelerator and WOM 11.2.1 through 11.3.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Metrics

EPSS Probability

1.55%

71.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
F5	Big-Ip Access Policy Manager	11.2.1
F5	Big-Ip Access Policy Manager	11.5.1
F5	Big-Ip Advanced Firewall Manager	11.2.1
F5	Big-Ip Advanced Firewall Manager	11.5.1
F5	Big-Ip Analytics	11.2.1
F5	Big-Ip Analytics	11.5.1
F5	Big-Ip Application Acceleration Manager	11.4.0
F5	Big-Ip Application Acceleration Manager	11.5.1
F5	Big-Ip Application Security Manager	11.2.1
F5	Big-Ip Application Security Manager	11.5.1
F5	Big-Ip Edge Gateway	11.2.1
F5	Big-Ip Edge Gateway	11.3.0
F5	Big-Ip Global Traffic Manager	11.2.1
F5	Big-Ip Global Traffic Manager	11.5.1
F5	Big-Ip Link Controller	11.2.1
F5	Big-Ip Link Controller	11.5.1
F5	Big-Ip Local Traffic Manager	11.2.1
F5	Big-Ip Local Traffic Manager	11.5.1
F5	Big-Ip Policy Enforcement Manager	11.3.0
F5	Big-Ip Policy Enforcement Manager	11.5.1
F5	Big-Ip Protocol Security Module	11.2.1
F5	Big-Ip Protocol Security Module	11.4.1
F5	Big-Ip Wan Optimization Manager	11.2.1
F5	Big-Ip Wan Optimization Manager	11.3.0
F5	Big-Ip Webaccelerator	11.2.1
F5	Big-Ip Webaccelerator	11.3.0
F5	Enterprise Manager	3.0.0
F5	Enterprise Manager	3.1.1

References

http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.htmlVendor Advisory
http://www.securityfocus.com/bid/67771Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030319Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030320Third Party Advisory, VDB Entry
http://secunia.com/advisories/58969
http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15296.htmlVendor Advisory
http://www.securityfocus.com/bid/67771Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030319Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030320Third Party Advisory, VDB Entry

Timeline

Published: Jun 3, 2014
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2014-3959?

How severe is CVE-2014-3959?

Severity scoring for CVE-2014-3959 is pending analysis. The EPSS model estimates a 1.55% probability of exploitation in the next 30 days.

How do I fix CVE-2014-3959?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-3959?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST