CVE-2020-5916
En bref Sévérité Non disponible EPSS EPSS 0.53 % · centile 45 (2026-10-28) État PUBLISHED Publiée 2020-08-26 Mise à jour 2024-08-04 Attribuée par f5 Statut NVD Modified Description In BIG-IP versions 15.1.0-15.1.0.4 and 15.0.0-15.0.1.3 the Certificate Administrator user role and higher privileged roles can perform arbitrary file reads outside of the web root directory.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 15.0.0 < 15.0.1.4cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 15.1.0 < 15.1.0.5Produits affectés Produit Versions BIG-IP affected 15.1.0-15.1.0.4, 15.0.0-15.0.1.3
Références
Sources
