Vulnerability

CERT-In Vulnerability Note CIVN-2020-0445
Cross Site Scripting Vulnerability in F5 BIG-IP Products

Original Issue Date:December 23, 2020

Severity Rating: HIGH

Software Affected

F5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM)

16.x versions 16.0.0
15.x versions 15.0.0 - 15.1.0
14.x versions 14.1.0 - 14.1.2
13.x versions 13.1.0 - 13.1.3
12.x versions 12.1.0 - 12.1.5
11.x versions 11.6.1 - 11.6.5

Overview

A reflected cross site scripting vulnerability has been reported in F5 BIG-IP Products which could allow an attacker to perform cross-site scripting (XSS) attack on the target system resulting in a complete compromise of the BIG-IP system if the victim user is granted the admin role.

Description

This vulnerability exists in multiple F5 BIG-IP products due to undisclosed endpoints in iControl REST feature. A remote attacker can exploit this vulnerability using a crafted URL to a reflected cross-site scripting (XSS) in an undisclosed page of the Configuration utility.

Successful exploitation of the vulnerability could allow an attacker to perform cross-site scripting (XSS) attack on the target system resulting in a complete compromise of the BIG-IP system if the victim user is granted the admin role.

Solution

Upgarde to fixed versions as mentioned in the F5 Advisory

Vendor Information

F5 Networks
https://support.f5.com/csp/article/K42696541

References

F5 Networks
https://support.f5.com/csp/article/K42696541

Tenable
https://www.tenable.com/cve/CVE-2020-5948

CVE Name
CVE-2020-5948

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India