CVE-2020-5873

7.2HIGH

Key Information:

Vendor
F5
Status
Big-ip
Big-iq
Vendor
CVE Published:
30 April 2020

Summary

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request.

Affected Version(s)

BIG-IP 15.0.0-15.0.1

BIG-IP 14.1.0-14.1.2.3

BIG-IP 13.1.0-13.1.3.1

References

https://support.f5.com/csp/article/K03585731
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.