PT-2020-18846 · F5 · F5 Big-Ip
Published
2020-12-11
·
Updated
2021-03-31
·
CVE-2020-5948
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
F5 BIG-IP versions 11.6.1 through 11.6.5.2
F5 BIG-IP versions 12.1.0 through 12.1.5.2
F5 BIG-IP versions 13.1.0 through 13.1.3.4
F5 BIG-IP versions 14.1.0 through 14.1.2.7
F5 BIG-IP versions 15.1.0 through 15.1.0.5
F5 BIG-IP versions 16.0.0 through 16.0.0.1
Description
The issue concerns undisclosed endpoints in iControl REST, which allow for a reflected XSS attack. This could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
Recommendations
For F5 BIG-IP versions 11.6.1 through 11.6.5.2, update to a version outside of this range to mitigate the risk.
For F5 BIG-IP versions 12.1.0 through 12.1.5.2, update to a version outside of this range to mitigate the risk.
For F5 BIG-IP versions 13.1.0 through 13.1.3.4, update to a version outside of this range to mitigate the risk.
For F5 BIG-IP versions 14.1.0 through 14.1.2.7, update to a version outside of this range to mitigate the risk.
For F5 BIG-IP versions 15.1.0 through 15.1.0.5, update to a version outside of this range to mitigate the risk.
For F5 BIG-IP versions 16.0.0 through 16.0.0.1, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the undisclosed endpoints in iControl REST to minimize the risk of exploitation.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
F5 Big-Ip