CVE Feed

    Dashboard / CVE / CVE-2024-47139

    CVE-2024-47139

    A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the context of the currently logged-in user.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published:Oct 16, 2024
    Last Modified:Aug 6, 2025
    EPS:Oct 16, 2024
    EPSS Score:0.00269
    CVSS Score:6.8

    Affected Products

    Vendor
    F5
    Product
    Big-iq
    Vendor
    F5
    Product
    Big-iq Centralized Management

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-66842 (CVSS 8.7) — BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user a…
    CVE-2026-41959 (CVSS 7.1) — Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnosti…
    CVE-2026-42406 (CVSS 8.5) — A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at …
    CVE-2026-32643 (CVSS 8.5) — A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at …
    CVE-2026-42937 (CVSS 7.1) — Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp comma…
    CVE-2026-40698 (CVSS 8.5) — A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at …
    CVE-2026-20916 (CVSS 7.2) — An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisc…
    CVE-2026-41957 (CVSS 8.7) — An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-…
    CVE-2026-41219 (CVSS 7.1) — An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attack…
    CVE-2026-41954 (CVSS 6.9) — Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High