CVE-2023-27378: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

Multiple reflected cross-site scripting (XSS) vulnerabilities were discovered in undisclosed pages of the BIG-IP Configuration utility (CVE-2023-27378). The vulnerability was disclosed on May 3, 2023, affecting various versions of F5's BIG-IP products including versions 13.1.0-13.1.5, 14.1.0-14.1.5.4, 15.1.0-15.1.8.2, 16.1.0-16.1.3.4, and 17.0.0-17.1.0.1 (NVD).

The vulnerability allows an attacker to execute JavaScript code in the context of the currently logged-in user through reflected cross-site scripting attacks. The CVSS v3.1 base score is 6.1 (MEDIUM) according to NVD assessment with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while F5 Networks assessed it with a score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to the execution of malicious JavaScript code in the context of the logged-in user's session, potentially compromising the confidentiality and integrity of user data. The attack requires user interaction and can be initiated remotely (NVD).

F5 has released security patches for affected versions. Users are advised to upgrade to the patched versions: 14.1.5.4, 15.1.8.2, 16.1.3.4, or 17.1.0.1 (NVD).