PT-2020-18793 · F5 · Big-Ip

Published 2020-04-30 · Updated 2021-07-21 · CVE-2020-5892

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 7.1.5 through 7.1.8

Description The issue allows attackers to obtain the full session ID from process memory in the BIG-IP Edge Client components of BIG-IP APM, Edge Gateway, and FirePass legacy.

Recommendations For versions 7.1.5 through 7.1.8, consider restricting access to sensitive areas of the application that rely on session IDs to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-5892

Affected Products

Big-Ip

References · 4

• https://osv.dev/vulnerability/CVE-2020-5892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5892 · Security Note
• https://support.f5.com/csp/article/K15838353 · Vendor Advisory
• https://t.me/cvenotify/3478 · Telegram Post