Forum Discussion

Nimbostratus

Jul 06, 2020

Community Question: K52145254: TMUI RCE vulnerability CVE-2020-5902

Editors Note: Authoritative answers for this CVE can be found at https://support.f5.com/csp/article/K52145254. -LZ. This vulnerability was recently announced and steps were take as suggested (obv...

MVP

Jul 06, 2020

This is very good document for reference: https://devcentral.f5.com/s/articles/Traffic-Management-User-Interface-Vulnerability-How-to-fix-it?srcHeader

Kb Article : https://support.f5.com/csp/article/K52145254

Amresh008
Nimbostratus
Jul 07, 2020
Samir, I have already gone through this document but this does not answer my query. One of my colleagues spoke to TAC and narrated me that as per TAC this vulnerability may allow (let's say an L1 engineer) with no actual rights to modify the services, can actually modify them.
- nmb-AskF5
  Employee
  Jul 13, 2020
  This is noted in the official Security Advisory, as of last week:
  
  "Note: Authenticated users will still be able to exploit the vulnerability, independent of their privilege level."
  
  Please refer to the official Security Advisory on AskF5 linked above for more detail on how to install a point release to patch the vulnerability. Thanks!