CVE-2020-5880: Malicious File Upload

Q: What is the severity of CVE-2020-5880?

CVE-2020-5880 has a high severity rating as it allows unauthorized file upload and may reveal sensitive server information.

Q: How do I fix CVE-2020-5880?

To fix CVE-2020-5880, upgrade your F5 BIG-IP systems to versions 15.0.1.4 or later, or 14.1.2.4 or later.

Q: What systems are affected by CVE-2020-5880?

CVE-2020-5880 affects F5 BIG-IP version 15.0.0 to 15.0.1.3 and version 14.1.0 to 14.1.2.3 across various modules.

Q: What risks are associated with CVE-2020-5880?

The risks associated with CVE-2020-5880 include unauthorized access for file uploads and the potential exposure of internal server paths.

Q: Is there a workaround for CVE-2020-5880 while waiting for a patch?

Currently, no specific workaround is published for CVE-2020-5880; the best action is to apply the recommended update as soon as possible.

Published Apr 30, 2020

Updated

Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server.

Affected Software

22 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Access Policy Manager>=15.0.0<=15.0.1.3

F5 BIG-IP Advanced Firewall Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Advanced Firewall Manager>=15.0.0<=15.0.1.3

F5 BIG-IP Analytics>=14.1.0<=14.1.2.3

F5 BIG-IP Analytics>=15.0.0<=15.0.1.3

F5 Big-ip Application Acceleration Manager>=14.1.0<=14.1.2.3

F5 Big-ip Application Acceleration Manager>=15.0.0<=15.0.1.3

F5 BIG-IP Application Security Manager>=14.1.0<=14.1.2.3

F5 BIG-IP Application Security Manager>=15.0.0<=15.0.1.3

F5 Big-ip Domain Name System>=14.1.0<=14.1.2.3

F5 Big-ip Domain Name System>=15.0.0<=15.0.1.3

F5 Big-ip Fraud Protection Service>=14.1.0<=14.1.2.3

F5 Big-ip Fraud Protection Service>=15.0.0<=15.0.1.3

F5 Big-ip Global Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Global Traffic Manager>=15.0.0<=15.0.1.3

F5 Big-ip Link Controller>=14.1.0<=14.1.2.3

F5 Big-ip Link Controller>=15.0.0<=15.0.1.3

F5 Big-ip Local Traffic Manager>=14.1.0<=14.1.2.3

F5 Big-ip Local Traffic Manager>=15.0.0<=15.0.1.3

F5 Big-ip Policy Enforcement Manager>=14.1.0<=14.1.2.3

F5 Big-ip Policy Enforcement Manager>=15.0.0<=15.0.1.3

Event History

Apr 30, 2020

CVE Published

via MITRE·08:54 PM

Data Sourced

via MITRE·08:54 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5880?

CVE-2020-5880 has a high severity rating as it allows unauthorized file upload and may reveal sensitive server information.

How do I fix CVE-2020-5880?

To fix CVE-2020-5880, upgrade your F5 BIG-IP systems to versions 15.0.1.4 or later, or 14.1.2.4 or later.

What systems are affected by CVE-2020-5880?