CVE-2020-5945

HIGH

F5 BIG-IP 14.1.0-14.1.2.7, 15.1.0-15.1.0.5, 16.0.0-16.0.0.1 - Stored Cross-Site Scripting in TMUI Page

Title source: llm
STIX 2.1

Description

In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://support.f5.com/csp/article/K21540525

Scores

CVSS v3 8.4
EPSS 0.0045
EPSS Percentile 64.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-79
Status published
Products (11)
f5/big-ip_access_policy_manager 14.1.0 - 14.1.2.8
f5/big-ip_advanced_firewall_manager 14.1.0 - 14.1.2.8
f5/big-ip_analytics 14.1.0 - 14.1.2.8
f5/big-ip_application_acceleration_manager 14.1.0 - 14.1.2.8
f5/big-ip_application_security_manager 14.1.0 - 14.1.2.8
f5/big-ip_domain_name_system 14.1.0 - 14.1.2.8
f5/big-ip_fraud_protection_service 14.1.0 - 14.1.2.8
f5/big-ip_global_traffic_manager 14.1.0 - 14.1.2.8
f5/big-ip_link_controller 14.1.0 - 14.1.2.8
f5/big-ip_local_traffic_manager 14.1.0 - 14.1.2.8
... and 1 more
Published Nov 05, 2020
Tracked Since Feb 18, 2026