Vulnerability Details : CVE-2020-5896
On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder permissions.
Products affected by CVE-2020-5896
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 13.1.0 and up to, including, (<=) 13.1.3.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 12.1.0 and up to, including, (<=) 12.1.5.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 15.0.0 and up to, including, (<=) 15.1.0.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 14.1.0 and up to, including, (<=) 14.1.2.5cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy ManagerVersions from including (>=) 11.6.1 and up to, including, (<=) 11.6.5.1cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- F5 » Big-ip Access Policy Manager ClientVersions from including (>=) 7.1.5 and up to, including, (<=) 7.1.9cpe:2.3:a:f5:big-ip_access_policy_manager_client:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-5896
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-5896
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2020-5896
-
During installation, installed file permissions are set to allow anyone to modify those files.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-5896
-
https://support.f5.com/csp/article/K15478554
Vendor Advisory
Jump to