CVE-2020-5943
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD
Description
In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password.
Affected (28)
Products: F5: Big Ip Access Policy Manager, Big Ip Advanced Firewall Manager, Big Ip Advanced Web Application Firewall, Big Ip Analytics, Big Ip Application Acceleration Manager, Big Ip Application Security Manager, Big Ip Ddos Hybrid Defender, Big Ip Domain Name System, Big Ip Fraud Protection Service, Big Ip Global Traffic Manager, Big Ip Link Controller, Big Ip Local Traffic Manager, Big Ip Policy Enforcement Manager, Big Ip Ssl Orchestrator
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 | |
| From 14.1.0 to 14.1.0.1 |
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.