K21540525: F5 TMUI XSS vulnerability CVE-2020-5945
Original Publication Date: Nov 03, 2020
Security Advisory Description
Undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin. (CVE-2020-5945)
Impact
A malicious, authenticated user with Resource Administrator privileges may be able to exploit this vulnerability to escalate their role to full Administrator privileges and execute system commands. This vulnerability is located in an undisclosed Configuration utility (TMUI) page.
Security Advisory Status
F5 Product Development has assigned ID 891457 (BIG-IP) to this vulnerability.
To determine if your product and version have been evaluated for this vulnerability, refer to the Applies to (see versions) box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases, point releases, or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to K51812227: Understanding security advisory versioning.
| Product | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature |
|---|---|---|---|---|---|---|
| BIG-IP (LTM, AAM, Advanced WAF, AFM, Analytics, APM, ASM, DDHD, DNS, FPS, GTM, Link Controller, PEM, SSLO) | ||||||
| 16.x | 16.0.0 | 16.0.1 | Medium | 6.8 | TMUI/Configuration utility | |
| 15.x | 15.0.0 – 15.1.0 | 15.1.1 | ||||
| 14.x | 14.1.0 – 14.1.2 | 14.1.2.8 | ||||
| 13.x | 13.1.0 – 13.1.3 | Not applicable | ||||
| 12.x | None | Not applicable | ||||
| 11.x | None | Not applicable | ||||
| BIG-IQ Centralized Management | ||||||
| 7.x | None | Not applicable | Not vulnerable | None | None | |
| 6.x | None | Not applicable | ||||
| 5.x | None | Not applicable | ||||
| Traffix SDC | ||||||
| 5.x |
1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.
Security Advisory Recommended Actions
If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Fixes introduced in column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.
Mitigation
To mitigate this vulnerability, you can disable TCP Segmentation Offload (TSO). You can do so by setting the value of the tm.tcpsegmentationoffload BigDB key to disable and restarting TMM. To do so, perform the following procedure:K13309: Restricting access to the Configuration utility by source IP address (11.x – 16.x) and K13092: Overview of securing access to the BIG-IP system.
Acknowledgements F5 would like to acknowledge Krzysztof Przybylski Consulting for bringing this issue to our attention, and for following the highest standards of coordinated disclosure.
Note: This link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.
Supplemental Information
- K41942608: Overview of security advisory articles
- K4602: Overview of the F5 security vulnerability response policy
- K4918: Overview of the F5 critical issue hotfix policy
- K9502: BIG-IP hotfix and point release matrix
- K13123: Managing BIG-IP product hotfixes (11.x – 16.x)
- K15106: Managing BIG-IQ product hotfixes
- K15113: BIG-IQ hotfix and point release matrix
- K48955220: Installing an OPSWAT Endpoint Security update on BIG-IP APM systems (11.4.x and later)
- K167: Downloading software and firmware from F5
- K9970: Subscribing to email notifications regarding F5 products
- K9957: Creating a custom RSS feed to view new and updated documents
