NetSight
IP …
high8.1

CVE-2020-5906

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files.

Impact

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.

Affected products

VendorProductAffected versions
F5Big-Ip Access Policy Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Advanced Firewall Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Analytics
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Application Acceleration Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Application Security Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Domain Name System
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Fraud Protection Service
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Global Traffic Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Link Controller
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Local Traffic Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3
F5Big-Ip Policy Enforcement Manager
from 11.6.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.1.0 through 13.1.3

Weakness classification

CWE-276

References