The vulnerabilities of BIG-IP’s access control and remote authentication mechanisms (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) are related to the lack of protective measures for the website structure. This allows attackers to carry out cross-site scripting attacks.

🗓️ 06 Sep 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Big IP access control and remote authentication flaws expose website structure and enable cross site scripting.

Reporter	Title	Published	Views	Family All 21
Circl	CVE-2020-5903	3 Jul 202017:08	–	circl
CNVD	F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2020-61639)	2 Jul 202000:00	–	cnvd
CVE	CVE-2020-5903	1 Jul 202014:42	–	cve
Cvelist	CVE-2020-5903	1 Jul 202014:42	–	cvelist
EUVD	EUVD-2020-27057	7 Oct 202500:30	–	euvd
GithubExploit	Exploit for Cross-site Scripting in F5 Big-Ip_Access_Policy_Manager	25 Aug 202002:07	–	githubexploit
F5 Networks	K43638305: BIG-IP TMUI XSS vulnerability CVE-2020-5903	21 Feb 202318:53	–	f5
Tenable Nessus	F5 Networks BIG-IP : BIG-IP TMUI XSS vulnerability (K43638305)	1 Jul 202000:00	–	nessus
NVD	CVE-2020-5903	1 Jul 202015:15	–	nvd
OSV	CVE-2020-5903	1 Jul 202015:15	–	osv

Vulners

Node

f5_networks,big-ip_access_policy_managerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_access_policy_managerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_access_policy_managerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_access_policy_managerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_access_policy_managerRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_advanced_firewall_managerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_advanced_firewall_managerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_advanced_firewall_managerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_advanced_firewall_managerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_advanced_firewall_managerRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_analyticsRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_analyticsRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_analyticsRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_analyticsRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_analyticsRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_application_acceleration_managerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_application_acceleration_managerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_application_acceleration_managerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_application_acceleration_managerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_application_acceleration_managerRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_application_security_managerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_application_security_managerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_application_security_managerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_application_security_managerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_application_security_managerRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_dnsRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_dnsRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_dnsRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_dnsRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_dnsRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_fraud_protection_serviceRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_fraud_protection_serviceRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_fraud_protection_serviceRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_fraud_protection_serviceRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_fraud_protection_serviceRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_global_traffic_managerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_global_traffic_managerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_global_traffic_managerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_global_traffic_managerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_global_traffic_managerRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_link_controllerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_link_controllerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_link_controllerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_link_controllerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_link_controllerRange15.1.0–15.1.0.4

OR

f5_networks,big-ip_local_traffic_managerRange12.1.0–12.1.5.2

OR

f5_networks,big-ip_local_traffic_managerRange13.1.0–13.1.3.4

OR

f5_networks,big-ip_local_traffic_managerRange14.1.0–14.1.2.6

OR

f5_networks,big-ip_local_traffic_managerRange15.0.0–15.0.1.4

OR

f5_networks,big-ip_local_traffic_managerRange15.1.0–15.1.0.4

Source	Link
support	www.support.f5.com/csp/article/K43638305
web	www.web.nvd.nist.gov/view/vuln/detail

29 Nov 2021 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 36.1

CVSS 26.4

EPSS0.02233

big ip vulnerabilities access control flaws remote authentication flaws website structure protection cross site scripting