CVE-2020-5943
En bref Sévérité Non disponible EPSS EPSS 0.53 % · centile 45 (2026-10-27) État PUBLISHED Publiée 2020-11-05 Mise à jour 2024-08-04 Attribuée par f5 Statut NVD Modified Description In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 14.1.0 ≤ 14.1.0.1cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:* ≥ 14.1.2.5 ≤ 14.1.2.7Produits affectés Produit Versions BIG-IP affected 14.1.0-14.1.0.1, 14.1.2.5-14.1.2.7
Références
Sources
