CVE-2020-5916: Medium severity f5 access policy manager vulnerability

Q: What is CVE-2020-5916?

CVE-2020-5916 is a vulnerability in BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 that allows the Certificate Administrator user role and higher privileged roles to perform arbitrary file reads outside of the web root directory.

Q: Which software versions are affected by CVE-2020-5916?

BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 are affected by CVE-2020-5916.

Q: What is the severity of CVE-2020-5916?

CVE-2020-5916 has a severity rating of 6.8 (medium).

Q: How can the arbitrary file reads vulnerability be exploited?

The vulnerability in CVE-2020-5916 can be exploited by the Certificate Administrator user role and higher privileged roles to read arbitrary files outside of the web root directory.

Q: Is there a fix available for CVE-2020-5916?

Yes, a fix is available for CVE-2020-5916. It is recommended to update to BIG-IP versions 15.1.0.5 or 15.0.1.4 to mitigate the vulnerability.

Published Aug 26, 2020

Updated

In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.

Affected Software

26 affected components

F5 BIG-IP Access Policy Manager>=15.0.0<15.0.1.4

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.0.5

F5 BIG-IP Advanced Firewall Manager>=15.0.0<15.0.1.4

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.0.5

F5 BIG-IP Analytics>=15.0.0<15.0.1.4

F5 BIG-IP Analytics>=15.1.0<15.1.0.5

F5 Big-ip Application Acceleration Manager>=15.0.0<15.0.1.4

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.0.5

F5 BIG-IP Application Security Manager>=15.0.0<15.0.1.4

F5 BIG-IP Application Security Manager>=15.1.0<15.1.0.5

F5 Big-ip Ddos Hybrid Defender>=15.0.0<15.0.1.4

F5 Big-ip Ddos Hybrid Defender>=15.1.0<15.1.0.5

F5 Big-ip Domain Name System>=15.0.0<15.0.1.4

F5 Big-ip Domain Name System>=15.1.0<15.1.0.5

F5 Big-ip Fraud Protection Service>=15.0.0<15.0.1.4

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.0.5

F5 Big-ip Global Traffic Manager>=15.0.0<15.0.1.4

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.0.5

F5 Big-ip Link Controller>=15.0.0<15.0.1.4

F5 Big-ip Link Controller>=15.1.0<15.1.0.5

F5 Big-ip Local Traffic Manager>=15.0.0<15.0.1.4

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.0.5

F5 Big-ip Policy Enforcement Manager>=15.0.0<15.0.1.4

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.0.5

F5 SSL Orchestrator>=15.0.0<15.0.1.4

F5 SSL Orchestrator>=15.1.0<15.1.0.5

Event History

Aug 26, 2020

CVE Published

via MITRE·02:25 PM

Data Sourced

via MITRE·02:25 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-5916?

CVE-2020-5916 is a vulnerability in BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 that allows the Certificate Administrator user role and higher privileged roles to perform arbitrary file reads outside of the web root directory.

Which software versions are affected by CVE-2020-5916?

BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 are affected by CVE-2020-5916.

What is the severity of CVE-2020-5916?