CVE-2021-22993: 
F5 BIG-IP Virtual Edition (tier - best) vulnerability analysis and mitigation

CVE-2021-22993 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting BIG-IP Advanced WAF and BIG-IP ASM products. The vulnerability was discovered in the DoS Profile properties page and affects multiple versions including 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3. The vulnerability was disclosed on March 31, 2021 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is network-based, requires low attack complexity, needs no privileges, but does require user interaction. The impact potential is high across confidentiality, integrity, and availability (NVD).

If successfully exploited, this DOM-based XSS vulnerability could allow an attacker to achieve high levels of impact across confidentiality, integrity, and availability of the affected systems. The vulnerability could potentially lead to unauthorized access to sensitive information, modification of system data, or disruption of service operations (NVD).

The vulnerability requires user interaction for successful exploitation, though it can be accessed remotely through network access. No authentication is required to exploit this vulnerability, making it potentially more accessible to attackers (NVD).

F5 has released patched versions to address this vulnerability. Users should upgrade to version 16.0.1.1, 15.1.2, 14.1.3.1, 13.1.3.6, or 12.1.5.3 depending on their current version track. Note that software versions which have reached End of Software Development (EoSD) are not evaluated (MITRE).