1. Home
  2. CVE Database
  3. CVE-2020-5940
MEDIUM · 5.4

CVE-2020-5940

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI...

Vulnerability Description

In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
F5Big-Ip Access Policy Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Advanced Firewall Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Analytics>= 14.1.0, < 14.1.2.4
F5Big-Ip Application Acceleration Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Application Security Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Domain Name System>= 14.1.0, < 14.1.2.4
F5Big-Ip Edge Gateway>= 14.1.0, < 14.1.2.4
F5Big-Ip Fraud Protection Service>= 14.1.0, < 14.1.2.4
F5Big-Ip Global Traffic Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Link Controller>= 14.1.0, < 14.1.2.4
F5Big-Ip Local Traffic Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Policy Enforcement Manager>= 14.1.0, < 14.1.2.4
F5Big-Ip Webaccelerator>= 14.1.0, < 14.1.2.4

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2020-5940?

CVE-2020-5940 is a vulnerability with a CVSS score of 5.4 (MEDIUM). In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI...

How severe is CVE-2020-5940?

CVE-2020-5940 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-5940?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager.