CVE-2020-5948 — Cross-site Scripting in F5 Big-ip Domain Name System

CWE-79 — Cross-site Scripting7 documents4 sources
Severity
9.6CRITICALNVD
EPSS
0.8%
top 25.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
F5 Big-ip Access Policy ManagerF5 Big-ip Advanced Firewall ManagerF5 Big-ip Analytics+8 more
Timeline
PublishedDec 11
Latest updateMay 24

Description

On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 2.8 | Impact: 6.0

Affected Packages12 packages

▶NVDf5/big-ip_domain_name_system13.1.0 — 13.1.3.5+3
▶NVDf5/big-ip_analytics13.1.0 — 13.1.3.5+3
▶NVDf5/big-ip_link_controller13.1.0 — 13.1.3.5+3
▶NVDf5/big-ip_access_policy_manager13.1.0 — 13.1.3.5+3
▶NVDf5/big-ip_local_traffic_manager13.1.0 — 13.1.3.5+3

🔴Vulnerability Details

4
GHSA
GHSA-c7r4-5f37-6572: On BIG-IP versions 16↗2022-05-24
▶
GHSA
GHSA-4484-gw7x-x6r9: On BIG-IP versions 16↗2022-05-24
▶
CVEList
CVE-2021-22994: On BIG-IP versions 16↗2021-03-31
▶
CVEList
CVE-2020-5948: On BIG-IP versions 16↗2020-12-11
▶

📋Vendor Advisories

2
F5
CVE-2021-22994: On BIG-IP versions 16↗2021-03-31
▶
F5
CVE-2020-5948: On BIG-IP versions 16↗2020-12-11
▶
CVE-2020-5948 — Cross-site Scripting in F5 | cvebase