cbcvebase.
CVE-2020-5905
published 2020-07-01

CVE-2020-5905: In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.

PriorityP419medium4.3CVSS 3.1
AVNACLPRHUIRSUCLILAL
EPSS
0.68%
51.9th percentile
In version 11.6.1-11.6.5.2 of the BIG-IP system Configuration utility Network > WCCP page, the system does not sanitize all user-provided data before display.

Affected

23 ranges
VendorProductVersion rangeFixed in
f5big-ip_aam——
f5big-ip_access_policy_manager——
f5big-ip_access_policy_manager11.6.1 – 11.6.5.2—
f5big-ip_advanced_firewall_manager11.6.1 – 11.6.5.2—
f5big-ip_afm——
f5big-ip_analytics——
f5big-ip_analytics11.6.1 – 11.6.5.2—
f5big-ip_apm——
f5big-ip_application_acceleration_manager11.6.1 – 11.6.5.2—
f5big-ip_application_security_manager11.6.1 – 11.6.5.2—
f5big-ip_asm——
f5big-ip_dns——
f5big-ip_domain_name_system11.6.1 – 11.6.5.2—
f5big-ip_fps——
f5big-ip_fraud_protection_service11.6.1 – 11.6.5.2—
f5big-ip_global_traffic_manager11.6.1 – 11.6.5.2—
f5big-ip_gtm——
f5big-ip_link_controller——
f5big-ip_link_controller11.6.1 – 11.6.5.2—
f5big-ip_local_traffic_manager11.6.1 – 11.6.5.2—
f5big-ip_ltm——
f5big-ip_pem——
f5big-ip_policy_enforcement_manager11.6.1 – 11.6.5.2—

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.