VDB

CVE-2020-5906

CVE-2020-5906 PUBLISHED CVSS 5.5 MEDIUM

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.

EPSS 0.13% · 32.2th percentile

Risk Scores

CVSS v2.0
5.5
EPSS Score
0.13%
32.2th percentile

Affected Products

VendorProductVersions
f5big-ip_application_acceleration_manager13.1.0, 11.6.1, 12.1.0
f5big-ip_policy_enforcement_manager13.1.0, 12.1.0, 11.6.1
f5big-ip_link_controller11.6.1, 13.1.0, 12.1.0
f5big-ip_domain_name_system11.6.1, 13.1.0, 12.1.0
f5big-ip_fraud_protection_service11.6.1, 12.1.0, 13.1.0
f5big-ip_analytics11.6.1, 12.1.0, 13.1.0
n/aBIG-IP13.1.0-13.1.3.3, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2
f5big-ip_access_policy_manager11.6.1, 13.1.0, 12.1.0
f5big-ip_advanced_firewall_manager11.6.1, 13.1.0, 12.1.0
f5big-ip_application_security_manager11.6.1, 13.1.0, 12.1.0
f5big-ip_global_traffic_manager12.1.0, 13.1.0, 11.6.1
f5big-ip_local_traffic_manager11.6.1, 13.1.0, 12.1.0

Timeline

  • Jul 1, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 22, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 25, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Feb 27, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 1, 2022 EPSS Score
  • Jul 2, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›