Detections
Analytics

F5 Networks BIG-IP : F5 TMUI XSS vulnerability (K21540525)

high Nessus Plugin ID 142359

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

Undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin. (CVE-2020-5945)

Impact

A malicious, authenticated user with Resource Administrator privileges may be able to exploit this vulnerability to escalate their role to full Administrator privileges andexecute system commands.This vulnerabilityis located in an undisclosedConfiguration utility (TMUI) page.

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K21540525.

See Also

https://my.f5.com/manage/s/article/K21540525

Plugin Details

Severity: High

ID: 142359

File Name: f5_bigip_SOL21540525.nasl

Version: 1.5

Type: local

Published: 11/3/2020

Updated: 11/2/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.5

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2020-5945

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_domain_name_system, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/h:f5:big-ip

Required KB Items: Host/local_checks_enabled, Settings/ParanoidReport, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/2/2020

Vulnerability Publication Date: 11/5/2020

Reference Information

CVE: CVE-2020-5945