Left unpatched, pair of vulnerabilities could give attackers wide access to a victim's application delivery network.

Dark Reading Staff, Dark Reading

July 3, 2020

1 Min Read

Two vulnerabilities, including one with a Common Vulnerability Scoring System (CVSS) score of 10, have been discovered in the F5 BIG-IP application delivery controller. Both vulnerabilities have now been patched in updates available to BIG-IP customers.

The more serious of the two, CVE-2020-5902, was a remote code execution vulnerability in the Traffic Management User Interface (TMUI). By exploiting this vulnerability, an unauthorized user could create or delete files, disable services, intercept information, run arbitrary system commands and Java code, completely compromise the system, and pursue further targets. Positive Technologies researcher Mikhail Klyuchnikov noted that this vulnerability is especially dangerous for that minority of BIG-IP owners who have exposed the TMUI to the Internet, where it can be discovered by tools such as Shodan.

The other vulnerability, CVE-2020-5903, is a cross-site scripting vulnerability in the BIG-IP Configuration utility. It could allow JavaScript with the permission of the targeted user, in the worst case allowing for remote arbitrary code execution without authorization. This vulnerability received a CVSS score of 7.5.

Both vulnerabilities have been patched in the most recent versions of BIG-IP. Customers are urged to update vulnerable versions immediately.

Read more here.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights