ID

VAR-202003-1561


CVE

CVE-2020-5858


TITLE

BIG-IP and BIG-IQ Vulnerability related to authority management in

Trust: 0.8

sources: JVNDB: JVNDB-2020-003526

DESCRIPTION

On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command. BIG-IP and BIG-IQ Exists in a privilege management vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Both F5 BIG-IP and F5 BIG-IQ are products of the US company F5. F5 BIG-IP is an application delivery platform that integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IQ is a software-based cloud management solution. The solution supports the deployment of application delivery and network services across public and private clouds, traditional data centers and hybrid environments. A security vulnerability exists in F5 BIG-IP and BIG-IQ. The following products and versions are affected: F5 BIG-IP 15.0.0 to 15.0.1.2, 14.1.0 to 14.1.2.2, 13.1.0 to 13.1.3.2, 12.1.0 to 12.1.5 , version 11.5.2 to version 11.6.5.1; BIG-IQ version 7.0.0, version 6.0.0 to version 6.1.0, version 5.2.0 to version 5.4.0,

Trust: 1.71

sources: NVD: CVE-2020-5858 // JVNDB: JVNDB-2020-003526 // VULHUB: VHN-183983

AFFECTED PRODUCTS

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:5.4.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:eqversion:7.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:lteversion:6.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:5.2.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.5

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-iq centralized managementscope:gteversion:6.0.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.6.5

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:14.1.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.3

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:15.0.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope: - version: -

Trust: 0.8

vendor:f5model:big-iq centralized managementscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-003526 // NVD: CVE-2020-5858

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-5858
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-003526
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202003-1657
value: HIGH

Trust: 0.6

VULHUB: VHN-183983
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-5858
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-003526
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-183983
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-5858
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-003526
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-183983 // JVNDB: JVNDB-2020-003526 // CNNVD: CNNVD-202003-1657 // NVD: CVE-2020-5858

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-269

Trust: 0.9

sources: VULHUB: VHN-183983 // JVNDB: JVNDB-2020-003526 // NVD: CVE-2020-5858

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202003-1657

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202003-1657

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-003526

PATCH

title:K36814487url:https://support.f5.com/csp/article/K36814487

Trust: 0.8

sources: JVNDB: JVNDB-2020-003526

EXTERNAL IDS

db:NVDid:CVE-2020-5858

Trust: 2.5

db:JVNDBid:JVNDB-2020-003526

Trust: 0.8

db:CNNVDid:CNNVD-202003-1657

Trust: 0.7

db:AUSCERTid:ESB-2021.3354

Trust: 0.6

db:CNVDid:CNVD-2020-21482

Trust: 0.1

db:VULHUBid:VHN-183983

Trust: 0.1

sources: VULHUB: VHN-183983 // JVNDB: JVNDB-2020-003526 // CNNVD: CNNVD-202003-1657 // NVD: CVE-2020-5858

REFERENCES

url:https://support.f5.com/csp/article/k36814487

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-5858

Trust: 1.4

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5858

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2021.3354

Trust: 0.6

url:https://vigilance.fr/vulnerability/f5-big-ip-privilege-escalation-via-tmos-shell-31892

Trust: 0.6

sources: VULHUB: VHN-183983 // JVNDB: JVNDB-2020-003526 // CNNVD: CNNVD-202003-1657 // NVD: CVE-2020-5858

SOURCES

db:VULHUBid:VHN-183983
db:JVNDBid:JVNDB-2020-003526
db:CNNVDid:CNNVD-202003-1657
db:NVDid:CVE-2020-5858

LAST UPDATE DATE

2024-11-23T23:08:04.007000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-183983date:2021-07-21T00:00:00
db:JVNDBid:JVNDB-2020-003526date:2020-04-17T00:00:00
db:CNNVDid:CNNVD-202003-1657date:2021-10-09T00:00:00
db:NVDid:CVE-2020-5858date:2024-11-21T05:34:42.950

SOURCES RELEASE DATE

db:VULHUBid:VHN-183983date:2020-03-27T00:00:00
db:JVNDBid:JVNDB-2020-003526date:2020-04-17T00:00:00
db:CNNVDid:CNNVD-202003-1657date:2020-03-27T00:00:00
db:NVDid:CVE-2020-5858date:2020-03-27T15:15:12.333