{ "id": "CVE-2020-5906", "sourceIdentifier": "f5sirt@f5.com", "published": "2020-07-01T15:15:15.673", "lastModified": "2023-01-27T16:38:01.903", "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP." }, { "lang": "es", "value": "En las versiones 13.1.0 hasta 13.1.3.3, 12.1.0 hasta 12.1.5.2 y 11.6.1 hasta 11.6.5.2, el sistema BIG-IP no aplica apropiadamente los controles de acceso para los archivos scp.blacklist. Esto permite a los usuarios de Admin y Resource Admin con acceso de protocolo Secure Copy (SCP) leer y sobrescribir archivos en la lista negra por medio de SCP" } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH" }, "exploitabilityScore": 2.8, "impactScore": 5.2 } ], "cvssMetricV2": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE", "baseScore": 5.5 }, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 4.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false } ] }, "weaknesses": [ { "source": "nvd@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-276" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "2FBA9552-4645-4BFF-91A4-47B6A3414325" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "6C3B5688-0235-4D4F-A26C-440FF24A1B43" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "6FCB6C17-33AC-4E5E-8633-7490058CA51F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "61D1B91F-8672-4947-AF9A-F635679D0FB7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "151ED6D1-AA85-4213-8F3A-8167CBEC4721" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "6F1C68BC-A3EF-4205-AD00-68CB3A8C65AF" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "C3787453-ECE9-4958-8FD8-8A43A9F86077" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "5D5AA99B-08E7-4959-A3B4-41AA527B4B22" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "4AC8FD5C-AE1A-4484-BB6F-EBB6A48D21F8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "05ED802A-A8A0-4E96-AB45-811A98AA11C2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "9DC86A5F-C793-4848-901F-04BFB57A07F6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "0772A366-87B9-40EC-9F63-AE0FF0EF5002" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "B15992E6-85B6-4E62-A284-FE4B78F5F373" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "2E5552A3-91CD-4B97-AD33-4F1FB4C8827A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "8A53C692-D353-42E3-9148-F850DA11884F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "8376922B-0D04-4E5D-BADE-0D6AC23A4696" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "55C2EC23-E78F-4447-BACF-21FC36ABF155" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "A35AC237-573B-4309-87EF-3945FA2449BF" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "0471086D-B70E-4B87-862E-01FB99B0D5D5" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "945A19E8-51EB-42FE-9BF1-12DAC78B5286" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "0B6C3F50-BD60-4A8C-8DBB-680DA4D6BE6D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "CD3D5803-35A0-4FF7-9AD3-E345C53A18FC" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "EB5007D0-BBDB-4D74-9C88-98FBA74757D1" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "FB07E847-6083-4CC8-8A62-6B9744B87088" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "E20DFBD1-5469-4330-81B1-078D6487C01D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "B7725810-66D2-4460-A174-9F3BFAD966F2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "0620AA57-83D1-41E6-8ABB-99F3FABB10F0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "F92F2449-8A6E-431E-8CB1-5255D2464B31" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "EFD760FE-4347-4D36-B5C6-4009398060F2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "BF552D91-612A-43E1-B2D6-02E2515FEA22" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.6.1", "versionEndIncluding": "11.6.5", "matchCriteriaId": "53F940F3-6CF4-48C8-BFBF-4FE9B3A26D31" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "12.1.0", "versionEndIncluding": "12.1.5", "matchCriteriaId": "65B76F53-7D8B-477E-8B6E-91AC0A9009FF" }, { "vulnerable": true, "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "13.1.0", "versionEndIncluding": "13.1.3", "matchCriteriaId": "6704F0A6-16E2-4C2D-B5BD-EDDEAD5C153C" } ] } ] } ], "references": [ { "url": "https://support.f5.com/csp/article/K82518062", "source": "f5sirt@f5.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://www.kb.cert.org/vuls/id/290915", "source": "f5sirt@f5.com", "tags": [ "Third Party Advisory", "US Government Resource" ] } ] }