CVE-2021-22979: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

A reflected Cross-Site Scripting (XSS) vulnerability was discovered in BIG-IP's Configuration utility (CVE-2021-22979). The vulnerability affects BIG-IP versions 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions when Fraud Protection Service is provisioned. The vulnerability was disclosed on January 6, 2021, and publicly announced on February 12, 2021 (CVE MITRE).

The vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned. It has received a CVSS v3.1 score of 7.5 (HIGH) and a CVSS v2.0 score of 7.8 (HIGH), indicating its significant severity (NVD).

The vulnerability allows an attacker to execute JavaScript in the context of the current logged-in user, potentially leading to unauthorized access to sensitive information or manipulation of the user's session (CVE MITRE).

F5 Networks has released patches for affected versions. Users are advised to upgrade to versions 16.0.1, 15.1.1, 14.1.2.8, or 13.1.3.5 depending on their current version. Note that software versions which have reached End of Software Development (EoSD) are not evaluated (CERT FR).