CVE-2020-5873: High severity f5 access policy manager vulnerability

Q: What is the severity of CVE-2020-5873?

The severity of CVE-2020-5873 is rated as high, posing significant risk to affected systems.

Q: How do I fix CVE-2020-5873?

To fix CVE-2020-5873, it is recommended to upgrade to a version of BIG-IP or BIG-IQ that is not affected by this vulnerability.

Q: Who is affected by CVE-2020-5873?

CVE-2020-5873 affects users with the Resource Administrator role in BIG-IP and BIG-IQ systems that have access to the secure copy utility.

Q: What are the affected versions in CVE-2020-5873?

Affected versions of BIG-IP include 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5, while BIG-IQ versions 5.2.0-7.1.0 are also impacted.

Q: What is the impact of CVE-2020-5873?

The impact of CVE-2020-5873 allows a user to execute arbitrary commands on the system, leading to potential unauthorized access and control.

Published Apr 30, 2020

Updated

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request.

Affected Software

58 affected components

F5 BIG-IP Access Policy Manager>=11.6.1<=11.6.5

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.5

F5 BIG-IP Access Policy Manager>=13.1.0<=13.1.3.1

F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1

F5 BIG-IQ Centralized Management>=5.2.0<=5.4.0

F5 BIG-IQ Centralized Management>=6.0.0<=6.1.0

F5 BIG-IQ Centralized Management>=7.0.0<=7.1.0

F5 BIG-IP Advanced Firewall Manager>=11.6.1<=11.6.5

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.5

F5 BIG-IP Advanced Firewall Manager>=13.1.0<=13.1.3.1

F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1

F5 BIG-IP Analytics>=11.6.1<=11.6.5

F5 BIG-IP Analytics>=12.1.0<=12.1.5

F5 BIG-IP Analytics>=13.1.0<=13.1.3.1

F5 BIG-IP Analytics>=14.1.0<=14.1.2.3

F5 BIG-IP Analytics>=15.0.0<=15.0.1

F5 Big-ip Application Acceleration Manager>=11.6.1<=11.6.5

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.5

F5 Big-ip Application Acceleration Manager>=13.1.0<=13.1.3.1

F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.2.3

F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1

F5 BIG-IP Application Security Manager>=11.6.1<=11.6.5

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.5

F5 BIG-IP Application Security Manager>=13.1.0<=13.1.3.1

F5 BIG-IP Application Security Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1

F5 Big-ip Domain Name System>=11.6.1<=11.6.5

F5 Big-ip Domain Name System>=12.1.0<=12.1.5

F5 Big-ip Domain Name System>=13.1.0<=13.1.3.1

F5 Big-ip Domain Name System>=14.1.0<=14.1.2.3

F5 Big-ip Domain Name System>=15.0.0<=15.0.1

F5 Big-ip Fraud Protection Service>=11.6.1<=11.6.5

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.5

F5 Big-ip Fraud Protection Service>=13.1.0<=13.1.3.1

F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.2.3

F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1

F5 Big-ip Global Traffic Manager>=11.6.1<=11.6.5

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.5

F5 Big-ip Global Traffic Manager>=13.1.0<=13.1.3.1

F5 Big-ip Global Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Global Traffic Manager>=15.0.0<=15.0.1

F5 Big-ip Link Controller>=11.6.1<=11.6.5

F5 Big-ip Link Controller>=12.1.0<=12.1.5

F5 Big-ip Link Controller>=13.1.0<=13.1.3.1

F5 Big-ip Link Controller>=14.1.0<=14.1.2.3

F5 Big-ip Link Controller>=15.0.0<=15.0.1

F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.5

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.5

F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.3.1

F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1

F5 Big-ip Policy Enforcement Manager>=11.6.1<=11.6.5

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.5

F5 Big-ip Policy Enforcement Manager>=13.1.0<=13.1.3.1

F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.2.3

F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1

Event History

Apr 30, 2020

CVE Published

via MITRE·08:21 PM

Data Sourced

via MITRE·08:21 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5873?

The severity of CVE-2020-5873 is rated as high, posing significant risk to affected systems.

How do I fix CVE-2020-5873?

To fix CVE-2020-5873, it is recommended to upgrade to a version of BIG-IP or BIG-IQ that is not affected by this vulnerability.

Who is affected by CVE-2020-5873?