CVE-2021-23038: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability, identified as CVE-2021-23038, was discovered in the BIG-IP Configuration utility. The vulnerability affects multiple versions of BIG-IP software including 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x. The vulnerability was assigned on January 6, 2021 (MITRE).

The vulnerability exists in an undisclosed page of the BIG-IP Configuration utility, allowing attackers to execute JavaScript code in the context of the currently logged-in user. This is classified as a stored XSS vulnerability, which means the malicious script is permanently stored on the target servers (MITRE).

The vulnerability allows attackers to execute JavaScript in the context of the currently logged-in user's session. This could potentially lead to unauthorized access to sensitive information, session hijacking, or manipulation of the BIG-IP Configuration utility's functionality (MITRE).

F5 Networks has released patched versions to address this vulnerability. Users should upgrade to version 16.0.1.2, 15.1.3.1, 14.1.4.2, or 13.1.4.1 depending on their current version. Systems running version 12.1.x should be upgraded to a supported version as no patch is available for this version (MITRE).