CVE-2025-24320
Published: 05 February 2025
Summary
CVE-2025-24320 is a high-severity Cross-site Scripting (CWE-79) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of information inputs to the BIG-IP Configuration utility, directly preventing the injection of malicious JavaScript payloads that enable stored XSS.
SI-15 mandates filtering of information outputs on vulnerable pages, ensuring injected scripts are neutralized before execution in the context of logged-in users.
SI-2 ensures timely remediation of known flaws like this incomplete fix for CVE-2024-31156 by applying vendor patches from the F5 advisory.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in network-accessible web config utility directly enables exploitation of public-facing applications (T1190) and arbitrary JavaScript execution in victim browser context (T1059.007).
NVD Description
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for…
more
CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Deeper analysisAI
CVE-2025-24320 is a stored cross-site scripting (XSS) vulnerability, associated with CWE-79, affecting an undisclosed page in the F5 BIG-IP Configuration utility. The issue arises from an incomplete fix for the prior vulnerability CVE-2024-31156 and enables an attacker to execute JavaScript in the context of the currently logged-in user. It carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.
Exploitation requires an attacker to have low-privilege (PR:L) authenticated access to the BIG-IP Configuration utility over the network (AV:N). By injecting a malicious payload onto the vulnerable page, the attacker can trigger JavaScript execution when another logged-in user accesses and interacts with the page (UI:R/AC:L). Successful exploitation allows high-impact outcomes, including unauthorized access to confidential data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), such as stealing session cookies or performing actions on behalf of the victim user.
The F5 security advisory at https://my.f5.com/manage/s/article/K000140578 provides details on mitigation, including available patches and any recommended workarounds.
Details
- CWE(s)