sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2020-5851 Security feature bypass in BIG-IP

Medium 4.6 Published Updated

Attackers can bypass TPM integrity checks on specific engineering hotfix builds, allowing undetected modifications to system components.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Local or same network only
Victim action needed
Not needed
Fix
None listed

What is CVE-2020-5851?

CVE-2020-5851 is a medium-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 14 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.2.0.45.4-ENG Hotfix-BIGIP-14.1.0.2.0.62.4-ENG

Which versions are affected by CVE-2020-5851?

It affects 13 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 7 more.

How do I fix CVE-2020-5851?

No fix has been published for CVE-2020-5851 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5851 being exploited?

There is no known exploitation of CVE-2020-5851 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-8qq9-995j-w4pc.

Is CVE-2020-5851 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free