CVE-2007-6704

Name of the Vulnerable Software and Affected Versions F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2 F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the query string to specific API endpoints, such as "my.activation.php3" and "my.logon.php3", when pre-logon sequences are enabled.

Recommendations For F5 FirePass 4100 SSL VPN versions 5.4.1 through 5.5.2, update to a version outside of this range to resolve the issue. For F5 FirePass 4100 SSL VPN versions 6.0 through 6.0.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the "my.activation.php3" and "my.logon.php3" endpoints until a patch is available.