CVE-2020-5940: XSS
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-5940.
What is the severity of CVE-2020-5940?
The severity of CVE-2020-5940 is medium with a CVSS score of 5.4.
Which software versions are affected by CVE-2020-5940?
Versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3 of the F5 BIG-IP Access Policy Manager, F5 BIG-IP Advanced Firewall Manager, F5 BIG-IP Analytics, F5 Big-ip Application Acceleration Manager, F5 BIG-IP Application Security Manager, F5 Big-ip Domain Name System, F5 Big-ip Edge Gateway, F5 Big-ip Fraud Protection Service, F5 Big-ip Global Traffic Manager, F5 Big-ip Link Controller, F5 Big-ip Local Traffic Manager, F5 Big-ip Policy Enforcement Manager, and F5 Big-ip Webaccelerator are affected by CVE-2020-5940.
What is the description of CVE-2020-5940?
CVE-2020-5940 is a stored cross-site scripting (XSS) vulnerability that exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI).
How do I fix CVE-2020-5940?
To fix CVE-2020-5940, users should upgrade to a version beyond the affected range: 14.1.2.4 for versions 14.1.0-14.1.2.3, 15.1.1 for versions 15.1.0-15.1.0.5, and 16.0.1 for versions 16.0.0-16.0.0.1.