CVE-2023-38138: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

A reflected cross-site scripting (XSS) vulnerability (CVE-2023-38138) was discovered in an undisclosed page of the BIG-IP Configuration utility. The vulnerability affects multiple versions of F5's BIG-IP products, including versions 13.1.0 through 17.1.0.2. This security issue was disclosed on August 2, 2023 (NVD).

The vulnerability is classified as a reflected XSS issue that exists in the BIG-IP Configuration utility. It has received a CVSS v3.1 base score of 6.1 (MEDIUM) from NIST and 7.5 (HIGH) from F5 Networks, with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows an attacker to execute JavaScript code in the context of the currently logged-in user's session. This could potentially lead to unauthorized access to sensitive information or manipulation of the user's session (NVD).

F5 has released security patches for affected versions. Users are advised to upgrade to versions 14.1.5.5, 15.1.9.1, 16.1.3.5, or 17.1.0.2 depending on their current version. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated (NVD).