CRITICAL
On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role
Published Dec 11, 2020
9.6
CRITICALCVSS 3.1
EPSS 1.03%
Description
On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.
Affected products
- Vendor n/a Product Big-IP Defaultn/a
- Version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Big-IP | n/a |
|
Configuration 1
OR
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
- ≥ 13.1.0 · < 13.1.3.5
Configuration 2
OR
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
- ≥ 14.1.0 · < 14.1.2.8
Configuration 3
OR
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
- ≥ 15.0.0 · < 15.1.1
Configuration 4
OR
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
- 16.0.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27102 Advisory
- https://support.f5.com/csp/article/K42696541 x_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27102 | Advisory | |
| https://support.f5.com/csp/article/K42696541 | x_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner f5
Published Dec 11, 2020
Updated Aug 4, 2024
Reserved Jan 6, 2020
Link CVE-2020-5948
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2020-27102 Assigner f5
Published Dec 11, 2020
Updated Aug 4, 2024
Exploited since n/a
Link EUVD-2020-27102