CVE-2009-2119

medium

Description

Cross-site scripting (XSS) vulnerability in the login interface (my.logon.php3) in F5 FirePass SSL VPN 5.5 through 5.5.2 and 6.0 through 6.0.3 allows remote attackers to inject arbitrary web script or HTML via a base64-encoded xcho parameter.

References

https://www.fox-it.com/uploads/pdf/advisory_xss_f5_firepass.pdf

https://www.fox-it.com/nl/nieuws-en-events/nieuws/laatste-nieuws/nieuwsartikel/f5-firepass-cross-site-scripting-vulnerability/106

https://exchange.xforce.ibmcloud.com/vulnerabilities/51064

http://www.vupen.com/english/advisories/2009/1570

http://www.securitytracker.com/id?1022387

http://www.securityfocus.com/bid/35312

http://www.securityfocus.com/archive/1/504232/100/0/threaded

http://secunia.com/advisories/35426

http://secunia.com/advisories/35418

http://osvdb.org/55040

Details

Source: Mitre, NVD

Published: 2009-06-18

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N