Details of VAR-202001-1699

ID

VAR-202001-1699

CVE

CVE-2020-5853

TITLE

BIG-IP APM portal access Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2020-001344

DESCRIPTION

In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict. BIG-IP APM portal access Contains a cross-site scripting vulnerability.The information may be obtained and the information may be falsified. F5 BIG-IP APM is a set of access and security solutions from F5 Corporation of the United States. The product provides unified access to business-critical applications and networks. A cross-site scripting vulnerability exists in F5 BIG-IP APM. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code. The following products and versions are affected: F5 BIG-IP APM 15.0.0 to 15.1.0, 14.0.0 to 14.1.2, 13.1.0 to 13.1.3, 12.1.0 to 12.1. 5 version, 11.5.2 version to 11.6.5 version

Trust: 1.71

sources: NVD: CVE-2020-5853 // JVNDB: JVNDB-2020-001344 // VULHUB: VHN-183978

AFFECTED PRODUCTS

vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	12.1.5	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	14.1.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	15.0.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	13.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	11.5.2	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	14.0.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	15.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	gte	version:	12.1.0	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	11.6.5	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	lte	version:	13.1.3	Trust: 1.0
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.2 to 11.6.5.1	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	12.1.0 to 12.1.5	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	13.1.0 to 13.1.3.2	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	14.0.0 to 14.1.2.3	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	15.0.0 to 15.1.0	Trust: 0.8
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.2	Trust: 0.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.7	Trust: 0.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.6	Trust: 0.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.4	Trust: 0.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.3	Trust: 0.6
vendor:	f5	model:	big-ip access policy manager	scope:	eq	version:	11.5.5	Trust: 0.6

sources: JVNDB: JVNDB-2020-001344 // CNNVD: CNNVD-202001-448 // NVD: CVE-2020-5853

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-5853
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-5853
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202001-448
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-183978
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2020-5853
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	CVE-2020-5853
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-183978
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-5853
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 1.0
NVD:	CVE-2020-5853
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-183978 // JVNDB: JVNDB-2020-001344 // CNNVD: CNNVD-202001-448 // NVD: CVE-2020-5853

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-183978 // JVNDB: JVNDB-2020-001344 // NVD: CVE-2020-5853

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202001-448

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202001-448

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-001344

PATCH

title:

K73183618

url:

https://support.f5.com/csp/article/K73183618

Trust: 0.8

sources: JVNDB: JVNDB-2020-001344

EXTERNAL IDS

db:	NVD	id:	CVE-2020-5853	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-001344	Trust: 0.8
db:	CNNVD	id:	CNNVD-202001-448	Trust: 0.7
db:	AUSCERT	id:	ESB-2020.0139	Trust: 0.6
db:	CNVD	id:	CNVD-2020-50291	Trust: 0.1
db:	VULHUB	id:	VHN-183978	Trust: 0.1

sources: VULHUB: VHN-183978 // JVNDB: JVNDB-2020-001344 // CNNVD: CNNVD-202001-448 // NVD: CVE-2020-5853

REFERENCES

url:	https://support.f5.com/csp/article/k73183618	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-5853	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5853	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.0139/	Trust: 0.6
url:	https://vigilance.fr/vulnerability/f5-big-ip-apm-cross-site-scripting-via-portal-access-31317	Trust: 0.6

sources: VULHUB: VHN-183978 // JVNDB: JVNDB-2020-001344 // CNNVD: CNNVD-202001-448 // NVD: CVE-2020-5853

SOURCES

db:	VULHUB	id:	VHN-183978
db:	JVNDB	id:	JVNDB-2020-001344
db:	CNNVD	id:	CNNVD-202001-448
db:	NVD	id:	CVE-2020-5853

LAST UPDATE DATE

2024-11-23T22:44:44.659000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-183978	date:	2020-01-17T00:00:00
db:	JVNDB	id:	JVNDB-2020-001344	date:	2020-02-03T00:00:00
db:	CNNVD	id:	CNNVD-202001-448	date:	2020-01-21T00:00:00
db:	NVD	id:	CVE-2020-5853	date:	2024-11-21T05:34:42.357

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-183978	date:	2020-01-14T00:00:00
db:	JVNDB	id:	JVNDB-2020-001344	date:	2020-02-03T00:00:00
db:	CNNVD	id:	CNNVD-202001-448	date:	2020-01-14T00:00:00
db:	NVD	id:	CVE-2020-5853	date:	2020-01-14T17:15:13.597