For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Gustavo_Lazarte's avatar
Gustavo_Lazarte
Icon for Nimbostratus rankNimbostratus
Oct 09, 2009

Cross-Script Audit

Hello,     I have upgraded to version 10.0 and I got audited with this cross-script vulnerability. I thought I turned off on 9.01. Do you know if I can trun off Cross-Script attacks on the...
config
design
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Oct 13, 2009
I can't see how adding a standard HTTP VIP on LTM would fix a XSS vulnerability in a web app. By default, LTM doesn't change the content of HTTP requests or responses. So unless you had an iRule or ASM enabled previously (well, not ASM as it wasn't available in 9.0/9.1) I don't think load balancing an application with LTM could have fixed the problem.

 

 

You might consider using a web application firewall like ASM to protect the application against XSS and other attacks.

 

 

Aaron