CVE-2020-5905 — Cross-site Scripting in F5 Big-ip Domain Name System

CWE-79 — Cross-site ScriptingCWE-20 — Improper Input Validation4 documents4 sources
Severity
4.3MEDIUMNVD
EPSS
0.3%
top 51.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Analytics+8 more
Timeline
PublishedJul 1
Latest updateMay 24

Description

In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:LExploitability: 0.9 | Impact: 3.4

Affected Packages12 packages

▶NVDf5/big-ip_domain_name_system11.6.1 — 11.6.5.2
▶NVDf5/big-ip_analytics11.6.1 — 11.6.5.2
▶NVDf5/big-ip_link_controller11.6.1 — 11.6.5.2
▶NVDf5/big-ip_access_policy_manager11.6.1 — 11.6.5.2
▶NVDf5/big-ip_local_traffic_manager11.6.1 — 11.6.5.2

🔴Vulnerability Details

2
GHSA
GHSA-5g86-x3mc-5fr5: In version 11↗2022-05-24
▶
CVEList
CVE-2020-5905: In version 11↗2020-07-01
▶

📋Vendor Advisories

1
F5
CVE-2020-5905: In version 11↗2020-07-01
▶
CVE-2020-5905 — Cross-site Scripting in F5 | cvebase