CVE-2020-5943: Medium severity f5 access policy manager vulnerability
In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5943?
CVE-2020-5943 is rated as potentially high severity due to the improper protection of sensitive data in the REST interface.
How do I fix CVE-2020-5943?
To mitigate CVE-2020-5943, you should upgrade to the latest version of the affected F5 BIG-IP software that has patched this vulnerability.
What versions are affected by CVE-2020-5943?
CVE-2020-5943 affects F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, and other modules in versions 14.1.0 to 14.1.2.7.
What type of data is exposed in CVE-2020-5943?
CVE-2020-5943 exposes sensitive fields such as passwords in the REST response instead of protecting them via SecureVault.
Is CVE-2020-5943 an authentication issue?
No, CVE-2020-5943 is not an authentication issue; it primarily deals with the improper handling of protected fields in REST API responses.