CVE-2020-5945: XSS

Q: What is the severity of CVE-2020-5945?

CVE-2020-5945 is classified as a moderate severity vulnerability due to its potential for privilege escalation.

Q: How do I fix CVE-2020-5945?

To fix CVE-2020-5945, upgrade your F5 BIG-IP software to a version above 16.0.0.1, 15.1.0.5, or 14.1.2.7.

Q: Which versions of F5 BIG-IP are affected by CVE-2020-5945?

The affected versions include F5 BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7.

Q: What kind of vulnerability is CVE-2020-5945?

CVE-2020-5945 is a stored Cross-Site Scripting (XSS) vulnerability that allows for minor privilege escalation.

Q: Who is impacted by CVE-2020-5945?

Resource administrators on affected F5 BIG-IP systems can potentially escalate privileges to full admin due to CVE-2020-5945.

Published Nov 5, 2020

Updated

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.

Affected Software

33 affected components

F5 BIG-IP Access Policy Manager>=14.1.0<14.1.2.8

F5 BIG-IP Access Policy Manager>=15.1.0<15.1.1

F5 BIG-IP Access Policy Manager>=16.0.0<16.0.1

F5 BIG-IP Advanced Firewall Manager>=14.1.0<14.1.2.8

F5 BIG-IP Advanced Firewall Manager>=15.1.0<15.1.1

F5 BIG-IP Advanced Firewall Manager>=16.0.0<16.0.1

F5 BIG-IP Analytics>=14.1.0<14.1.2.8

F5 BIG-IP Analytics>=15.1.0<15.1.1

F5 BIG-IP Analytics>=16.0.0<16.0.1

F5 Big-ip Application Acceleration Manager>=14.1.0<14.1.2.8

F5 Big-ip Application Acceleration Manager>=15.1.0<15.1.1

F5 Big-ip Application Acceleration Manager>=16.0.0<16.0.1

F5 BIG-IP Application Security Manager>=14.1.0<14.1.2.8

F5 BIG-IP Application Security Manager>=15.1.0<15.1.1

F5 BIG-IP Application Security Manager>=16.0.0<16.0.1

F5 Big-ip Domain Name System>=14.1.0<14.1.2.8

F5 Big-ip Domain Name System>=15.1.0<15.1.1

F5 Big-ip Domain Name System>=16.0.0<16.0.1

F5 Big-ip Fraud Protection Service>=14.1.0<14.1.2.8

F5 Big-ip Fraud Protection Service>=15.1.0<15.1.1

F5 Big-ip Fraud Protection Service>=16.0.0<16.0.1

F5 Big-ip Global Traffic Manager>=14.1.0<14.1.2.8

F5 Big-ip Global Traffic Manager>=15.1.0<15.1.1

F5 Big-ip Global Traffic Manager>=16.0.0<16.0.1

F5 Big-ip Link Controller>=14.1.0<14.1.2.8

F5 Big-ip Link Controller>=15.1.0<15.1.1

F5 Big-ip Link Controller>=16.0.0<16.0.1

F5 Big-ip Local Traffic Manager>=14.1.0<14.1.2.8

F5 Big-ip Local Traffic Manager>=15.1.0<15.1.1

F5 Big-ip Local Traffic Manager>=16.0.0<16.0.1

F5 Big-ip Policy Enforcement Manager>=14.1.0<14.1.2.8

F5 Big-ip Policy Enforcement Manager>=15.1.0<15.1.1

F5 Big-ip Policy Enforcement Manager>=16.0.0<16.0.1

Event History

Nov 5, 2020

CVE Published

via MITRE·07:21 PM

Data Sourced

via MITRE·07:21 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2020-5945?

CVE-2020-5945 is classified as a moderate severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2020-5945?

To fix CVE-2020-5945, upgrade your F5 BIG-IP software to a version above 16.0.0.1, 15.1.0.5, or 14.1.2.7.

Which versions of F5 BIG-IP are affected by CVE-2020-5945?