CVE-2020-5893 — LOW (3.7) — White Hats Nepal

Q: How severe is CVE-2020-5893?

CVE-2020-5893 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2020-5893?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Access Policy Manager Client.

Vulnerability Description

In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
F5	Big-Ip Access Policy Manager	>= 11.6.1, <= 11.6.5
F5	Big-Ip Access Policy Manager Client	>= 7.1.5, < 7.1.9

Related Weaknesses (CWE)

CWE-319

References

https://support.f5.com/csp/article/K97733133Vendor Advisory
https://support.f5.com/csp/article/K97733133Vendor Advisory

FAQ

What is CVE-2020-5893?

CVE-2020-5893 is a vulnerability with a CVSS score of 3.7 (LOW). In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for capt...

How severe is CVE-2020-5893?

CVE-2020-5893 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-5893?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Access Policy Manager Client.