AppCheck Plug-in for CVE-2020-5902 & CVE-2020-5903

AppCheck have released a new plug-in to detect recently discovered security flaws within F5 BIG-IP devices, CVE-2020-5902 and CVE-2020-5903.

AppCheck plug-in details

AppCheck have released a new plug-in to detect recently discovered security flaws within F5 BIG-IP devices, CVE-2020-5902 and CVE-2020-5903.

If these vulnerabilities may affect you then we strongly recommend a scan to detect them and some quick fixes.

 

About the flaws

CVE-2020-5902 is a Remote Code Execution (RCE) vulnerability.

‘The Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.’

This vulnerability may allow an attacker to execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code. It is possible for an attacker to achieve complete system compromise.

F5 recommends upgrading to a fixed software version to fully mitigate this vulnerability.

 

CVE-2020-5903 is a Cross-site Scripting (XSS) vulnerability.

‘A Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.’

Attackers can exploit this vulnerability to run JavaScript in the context of the currently logged-in user. If an attacker were to target an admin user, the vulnerability could be leveraged to completely compromise the BIG-IP system through Remote Code Execution.

F5 recommend in terms of mitigation: ‘you should permit management access to F5 products only over a secure network, and limit shell access to only trusted users.’

 

Scoring 7.5/10 and 10/10 on the CVSSv3 vulnerability severity scale, this is an extremely serious pair of vulnerabilities. This is made even more serious by the fact it is used by many enterprise companies including governments and Fortune 500 companies.

 

Additional Information

If you require additional information, please get in touch with us at info@localhost

If you would like to see if AppCheck can discover this vulnerability (as well as thousands more) simply click the free trial scan button below.

Get a free vulnerability scan for your business

Enquire now

Get started with Appcheck

No software to download or install.

Contact us or call us 0113 887 8380

About Appcheck

AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network and cloud infrastructure. AppCheck are authorized by te Common Vulnerabilities and Exposures (CVE) Program aas a CVE Numbering Authority (CNA)

No software to download or install.
Contact us or call us 0113 887 8380

Start your free trial

Your details
IP Addresses
URLs

Get in touch