CVE-2020-27729: 
F5 BIG-IP Virtual Edition vulnerability analysis and mitigation

An open redirect vulnerability (CVE-2020-27729) was discovered in F5 BIG-IP APM virtual server. The vulnerability affects multiple versions including 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2. The vulnerability was disclosed in December 2020 and allows malicious users to build an open redirect URI through an undisclosed link (NVD).

The vulnerability is classified as a URL Redirection to Untrusted Site ('Open Redirect') vulnerability (CWE-601). It received a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required. The CVSS v2.0 Base Score is 5.8 (Medium) (NVD).

The vulnerability allows attackers to redirect users to untrusted sites through the BIG-IP APM virtual server. This can potentially lead to phishing attacks and compromise of user credentials or sensitive information (NVD).

The vulnerability requires no privileges to exploit but does require user interaction. The attack can be conducted remotely through network access (NVD).

F5 has released security patches for affected versions. For versions 12.1.x and 11.6.x, F5 will not provide patches for CVE-2020-27729. Users are recommended to upgrade to a supported version with the security fix (CERT-FR).