CVE-2020-5889

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.

Score

CVSS 3.1 5.4 Medium

Status

Modified - f5sirt@f5.com

Published

2020-04-30

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Big-ip Access Policy Manager (F5)

References

• https://support.f5.com/csp/article/K24415506