CVE-2020-5906 - In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files

Back Back to CVE browser

HIGH

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files

Published Jul 1, 2020

8.1

HIGH

CVSS 3.1

EPSS 1.19%

Description

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.

Affected products

Vendor n/a Product Big-IP Default
n/a
- Version
  13.1.0-13.1.3.3, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Big-IP

n/a

Version	Status	Constraints
13.1.0-13.1.3.3, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27060
Advisory
https://support.f5.com/csp/article/K82518062
x_refsource_MISCVendor Advisory
https://www.kb.cert.org/vuls/id/290915
third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27060		Advisory
https://support.f5.com/csp/article/K82518062		x_refsource_MISCVendor Advisory
https://www.kb.cert.org/vuls/id/290915		third-party-advisoryx_refsource_CERT-VNThird Party AdvisoryUS Government Resource