BIG-IP Configuration utility vulnerability

The BIG-IP Configuration utility has hidden pages that a logged-in user with low privileges can access to view sensitive information they shouldn't see. This is a problem because attackers with basic account access can discover and read data meant to be restricted.

An XPath injection vulnerability (CWE-643) in undisclosed Configuration utility pages permits low-privileged authenticated users to bypass access controls and retrieve sensitive information. The attack requires prior authentication but no elevated privileges, allowing horizontal or vertical privilege escalation through information disclosure.