CVE-2023-38138

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
F5BIG-IP>= 17.1.0, < 17.1.0.2; >= 16.1.0, < 16.1.3.5; >= 15.1.0, < 15.1.9.1; >= 14.1.0, < 14.1.5.5; >= 13.1.0, < *

References

Timeline

Published
Aug 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-381397.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-38144.9The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site adCVE-2023-381405.5Windows Kernel Information Disclosure VulnerabilityCVE-2023-381417.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-381427.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2023-381437.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2023-381447.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2023-381468.8Windows Themes Remote Code Execution VulnerabilityCVE-2023-381478.8Windows Miracast Wireless Display Remote Code Execution VulnerabilityCVE-2023-381488.8Internet Connection Sharing (ICS) Remote Code Execution VulnerabilityCVE-2023-381497.5Windows TCP/IP Denial of Service VulnerabilityCVE-2023-38156.1A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function
CVE-2023-38138: Medium severity, CVSS 6.1 | Vulnix