CVE-2007-5979

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-11-15 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in download_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.

Affected products

F5 Firepass 4100: 5.4, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5 (+8)

References

http://osvdb.org/38665
http://secunia.com/advisories/27647
http://securityreason.com/securityalert/3364
http://www.procheckup.com/Vulnerability_PR07-13.php
http://www.securityfocus.com/archive/1/483601/100/0/threaded
http://www.securityfocus.com/bid/26412
http://www.securitytracker.com/id?1018937
http://www.vupen.com/english/advisories/2007/3847
https://exchange.xforce.ibmcloud.com/vulnerabilities/38439
https://support.f5.com/kb/en-us/solutions/public/7000/400/sol7498.html
http://osvdb.org/38665
http://secunia.com/advisories/27647

Get alerted when CVE-2007-5979 or the next vulnerability affects your stack