LDAP Authentication Whitespace Exposure on F5 BIG-IP Products
CVE-2020-5890

5.5MEDIUM

Key Information:

Vendor

F5
Status
Big-ip
Big-iq
Vendor
CVE Published:
30 April 2020

What is CVE-2020-5890?

A vulnerability exists in the F5 BIG-IP products when creating a QKView. If the LDAP server credentials used for remote authentication contain whitespace, they are not fully obfuscated, potentially exposing sensitive information to unauthorized individuals. This can lead to unauthorized access to the BIG-IP administrative interface, compromising the security of the environment.

Affected Version(s)

BIG-IP 15.0.0-15.0.1

BIG-IP 14.1.0-14.1.2.3

BIG-IP 13.1.0-13.1.3.3

References

https://support.f5.com/csp/article/K03318649
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.