CVE-2020-27727: Input Validation

Q: What is the severity of CVE-2020-27727?

CVE-2020-27727 has a high severity rating due to the potential for unauthorized file system access by authenticated users.

Q: How do I fix CVE-2020-27727?

To fix CVE-2020-27727, upgrade your F5 BIG-IP software to a version that is not affected, specifically to version 16.0.1.1, 15.1.1, 14.1.3.1, or 13.1.3.5 or later.

Q: Who is affected by CVE-2020-27727?

Affected users include administrators running BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4.

Q: What are the implications of CVE-2020-27727?

The implications of CVE-2020-27727 include the risk of sensitive data exposure and potential system compromise due to insufficient input validation.

Q: Is CVE-2020-27727 remotely exploitable?

CVE-2020-27727 is not remotely exploitable as it requires authentication by an administrative user.

Published Dec 24, 2020

Updated

On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.

Affected Software

44 affected components

F5 BIG-IP Access Policy Manager>=13.1.0<13.1.3.5

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.3.1

F5 BIG-IP Access Policy Manager>=15.0.0<15.1.1

F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1.1

F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.3.5

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.3.1

F5 BIG-IP Advanced Firewall Manager>=15.0.0<15.1.1

F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1.1

F5 BIG-IP Analytics>=13.1.0<13.1.3.5

F5 BIG-IP Analytics>=14.1.0<14.1.3.1

F5 BIG-IP Analytics>=15.0.0<15.1.1

F5 BIG-IP Analytics>=16.0.0<16.0.1.1

F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.3.5

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.3.1

F5 Big-ip Application Acceleration Manager>=15.0.0<15.1.1

F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1.1

F5 BIG-IP Application Security Manager>=13.1.0<13.1.3.5

F5 BIG-IP Application Security Manager>=14.1.0<14.1.3.1

F5 BIG-IP Application Security Manager>=15.0.0<15.1.1

F5 BIG-IP Application Security Manager>=16.0.0<16.0.1.1

F5 Big-ip Domain Name System>=13.1.0<13.1.3.5

F5 Big-ip Domain Name System>=14.1.0<14.1.3.1

F5 Big-ip Domain Name System>=15.0.0<15.1.1

F5 Big-ip Domain Name System>=16.0.0<16.0.1.1

F5 Big-ip Fraud Protection Service>=13.1.0<13.1.3.5

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.3.1

F5 Big-ip Fraud Protection Service>=15.0.0<15.1.1

F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1.1

F5 Big-ip Global Traffic Manager>=13.1.0<13.1.3.5

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.3.1

F5 Big-ip Global Traffic Manager>=15.0.0<15.1.1

F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Link Controller>=13.1.0<13.1.3.5

F5 Big-ip Link Controller>=14.1.0<14.1.3.1

F5 Big-ip Link Controller>=15.0.0<15.1.1

F5 Big-ip Link Controller>=16.0.0<16.0.1.1

F5 Big-ip Local Traffic Manager>=13.1.0<13.1.3.5

F5 Big-ip Local Traffic Manager>=14.1.0<14.1.3.1

F5 Big-ip Local Traffic Manager>=15.0.0<15.1.1

F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1.1

F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.3.5

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.3.1

F5 Big-ip Policy Enforcement Manager>=15.0.0<15.1.1

F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1.1

Event History

Dec 24, 2020

CVE Published

via MITRE·03:03 PM

Data Sourced

via MITRE·03:03 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-27727?

CVE-2020-27727 has a high severity rating due to the potential for unauthorized file system access by authenticated users.

How do I fix CVE-2020-27727?

To fix CVE-2020-27727, upgrade your F5 BIG-IP software to a version that is not affected, specifically to version 16.0.1.1, 15.1.1, 14.1.3.1, or 13.1.3.5 or later.

Who is affected by CVE-2020-27727?