CVE-2020-5906
En bref Sévérité Non disponible EPSS EPSS 1.19 % · centile 68 (2026-10-27) État PUBLISHED Publiée 2020-07-01 Mise à jour 2024-08-04 Attribuée par f5 Statut NVD Modified Description In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 11.6.1 ≤ 11.6.5cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 12.1.0 ≤ 12.1.5cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 13.1.0 ≤ 13.1.3Produits affectés Produit Versions BIG-IP affected 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2
Références
Sources
