CVE-2020-5916 — Improper Privilege Management in F5 Big-ip Access Policy Manager

CWE-269 — Improper Privilege ManagementCWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
0.1%
top 72.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Analytics+10 more
Timeline
PublishedAug 26
Latest updateMay 24

Description

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NExploitability: 2.3 | Impact: 4.0

Affected Packages14 packages

▶NVDf5/big-ip_analytics15.0.0 — 15.0.1.4+1
▶NVDf5/ssl_orchestrator15.0.0 — 15.0.1.4+1
▶NVDf5/big-ip_link_controller15.0.0 — 15.0.1.4+1
▶NVDf5/big-ip_domain_name_system15.0.0 — 15.0.1.4+1
▶NVDf5/big-ip_ddos_hybrid_defender15.0.0 — 15.0.1.4+1

🔴Vulnerability Details

2
GHSA
GHSA-r8qr-9pg9-x57w: In BIG-IP versions 15↗2022-05-24
▶
CVEList
CVE-2020-5916: In BIG-IP versions 15↗2020-08-26
▶

📋Vendor Advisories

1
F5
CVE-2020-5916: In BIG-IP versions 15↗2020-08-26
▶
CVE-2020-5916 — Improper Privilege Management in F5 | cvebase