CVE-2020-5906: High severity f5 access policy manager vulnerability

Q: What is the severity of CVE-2020-5906?

CVE-2020-5906 is considered a high-severity vulnerability due to its potential to allow unauthorized access to sensitive files.

Q: How do I fix CVE-2020-5906?

To mitigate CVE-2020-5906, upgrade to the latest versions of BIG-IP systems as specified in the security advisory by F5 Networks.

Q: Who is affected by CVE-2020-5906?

CVE-2020-5906 affects users of F5 BIG-IP systems, specifically those running versions 11.6.1 to 11.6.5.2, 12.1.0 to 12.1.5.2, and 13.1.0 to 13.1.3.3.

Q: What can happen if CVE-2020-5906 is exploited?

If exploited, CVE-2020-5906 can allow Admin and Resource Admin users with SCP access to read and overwrite blacklisted files.

Q: Is there a workaround for CVE-2020-5906 if an upgrade cannot be done immediately?

Currently, there are no publicly documented workarounds for CVE-2020-5906, so immediate upgrading is recommended.

Published Jul 1, 2020

Updated

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.

Affected Software

33 affected components

F5 BIG-IP Access Policy Manager>=11.6.1<=11.6.5

F5 BIG-IP Access Policy Manager>=12.1.0<=12.1.5

F5 BIG-IP Access Policy Manager>=13.1.0<=13.1.3

F5 BIG-IP Advanced Firewall Manager>=11.6.1<=11.6.5

F5 BIG-IP Advanced Firewall Manager>=12.1.0<=12.1.5

F5 BIG-IP Advanced Firewall Manager>=13.1.0<=13.1.3

F5 BIG-IP Analytics>=11.6.1<=11.6.5

F5 BIG-IP Analytics>=12.1.0<=12.1.5

F5 BIG-IP Analytics>=13.1.0<=13.1.3

F5 Big-ip Application Acceleration Manager>=11.6.1<=11.6.5

F5 Big-ip Application Acceleration Manager>=12.1.0<=12.1.5

F5 Big-ip Application Acceleration Manager>=13.1.0<=13.1.3

F5 BIG-IP Application Security Manager>=11.6.1<=11.6.5

F5 BIG-IP Application Security Manager>=12.1.0<=12.1.5

F5 BIG-IP Application Security Manager>=13.1.0<=13.1.3

F5 Big-ip Domain Name System>=11.6.1<=11.6.5

F5 Big-ip Domain Name System>=12.1.0<=12.1.5

F5 Big-ip Domain Name System>=13.1.0<=13.1.3

F5 Big-ip Fraud Protection Service>=11.6.1<=11.6.5

F5 Big-ip Fraud Protection Service>=12.1.0<=12.1.5

F5 Big-ip Fraud Protection Service>=13.1.0<=13.1.3

F5 Big-ip Global Traffic Manager>=11.6.1<=11.6.5

F5 Big-ip Global Traffic Manager>=12.1.0<=12.1.5

F5 Big-ip Global Traffic Manager>=13.1.0<=13.1.3

F5 Big-ip Link Controller>=11.6.1<=11.6.5

F5 Big-ip Link Controller>=12.1.0<=12.1.5

F5 Big-ip Link Controller>=13.1.0<=13.1.3

F5 Big-ip Local Traffic Manager>=11.6.1<=11.6.5

F5 Big-ip Local Traffic Manager>=12.1.0<=12.1.5

F5 Big-ip Local Traffic Manager>=13.1.0<=13.1.3

F5 Big-ip Policy Enforcement Manager>=11.6.1<=11.6.5

F5 Big-ip Policy Enforcement Manager>=12.1.0<=12.1.5

F5 Big-ip Policy Enforcement Manager>=13.1.0<=13.1.3

Event History

Jul 1, 2020

CVE Published

via MITRE·02:33 PM

Data Sourced

via MITRE·02:33 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5906?

CVE-2020-5906 is considered a high-severity vulnerability due to its potential to allow unauthorized access to sensitive files.

How do I fix CVE-2020-5906?

To mitigate CVE-2020-5906, upgrade to the latest versions of BIG-IP systems as specified in the security advisory by F5 Networks.

Who is affected by CVE-2020-5906?