CVE-2020-5904
published 2020-07-01CVE-2020-5904: In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic…
PriorityP340high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.56%
42.7th percentile
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_access_policy_manager | 12.1.0 – 12.1.5.1 | — |
| f5 | big-ip_access_policy_manager | 13.1.0 – 13.1.3.3 | — |
| f5 | big-ip_access_policy_manager | 14.1.0 – 14.1.2.5 | — |
| f5 | big-ip_access_policy_manager | 15.0.0 – 15.1.0.3 | — |
| f5 | big-ip_advanced_firewall_manager | 12.1.0 – 12.1.5.1 | — |
| f5 | big-ip_advanced_firewall_manager | 13.1.0 – 13.1.3.3 | — |
| f5 | big-ip_advanced_firewall_manager | 14.1.0 – 14.1.2.5 | — |
| f5 | big-ip_advanced_firewall_manager | 15.0.0 – 15.1.0.3 | — |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 12.1.0 – 12.1.5.1 | — |
| f5 | big-ip_analytics | 13.1.0 – 13.1.3.3 | — |
| f5 | big-ip_analytics | 14.1.0 – 14.1.2.5 | — |
| f5 | big-ip_analytics | 15.0.0 – 15.1.0.3 | — |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 12.1.0 – 12.1.5.1 | — |
| f5 | big-ip_application_acceleration_manager | 13.1.0 – 13.1.3.3 | — |
| f5 | big-ip_application_acceleration_manager | 14.1.0 – 14.1.2.5 | — |
| f5 | big-ip_application_acceleration_manager | 15.0.0 – 15.1.0.3 | — |
| f5 | big-ip_application_security_manager | 12.1.0 – 12.1.5.1 | — |
| f5 | big-ip_application_security_manager | 13.1.0 – 13.1.3.3 | — |
| f5 | big-ip_application_security_manager | 14.1.0 – 14.1.2.5 | — |
| f5 | big-ip_application_security_manager | 15.0.0 – 15.1.0.3 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2020-5904: In BIG-IP versions 15
vendor_f5·2020-07-01·CVSS 8.8
CVE-2020-5904 [HIGH] CWE-352 CVE-2020-5904: In BIG-IP versions 15
CVE-2020-5904: In BIG-IP versions 15
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Analytics, BIG-IP DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM
Affected Versions: 12.1.0 - 12.1.5.1; 13.1.0 - 13.1.3.3; 14.1.0 - 14.1.2.5; 15.0.0 - 15.1.0.3; 15.1.0 - 15.1.0.3
F5 Advisory Articles: K31301245
F5 References: https://support.f5.com/csp/article/K31301245
GHSA
GHSA-hh34-5488-xhfc: In BIG-IP versions 15
ghsa_unreviewed·2022-05-24
CVE-2020-5904 [MEDIUM] GHSA-hh34-5488-xhfc: In BIG-IP versions 15
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, a cross-site request forgery (CSRF) vulnerability in the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, exists in an undisclosed page.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-07-01
Published