CVE-2020-5915: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-5915) was discovered in BIG-IP's Traffic Management User Interface (TMUI) or Configuration Utility component. The vulnerability affects multiple versions of BIG-IP products including versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1. This vulnerability specifically occurs when BIG-IP systems are set up in a device trust configuration (CERT-EU, CVE-MITRE).

The vulnerability exists due to insufficient sanitization of user input in the TMUI/Configuration Utility component. An attacker with Resource Administrator or Administrator privileges can exploit this vulnerability to inject HTML or JavaScript code into a vulnerable section of the application. When a logged-in user views the affected section, the injected code is rendered in their browser (CERT-EU).

The successful exploitation of this vulnerability could allow an attacker to steal cookie-based authentication credentials and control how the site is rendered to the user. This could potentially lead to various client-side attack techniques and broader security implications (CERT-EU).

The vulnerability requires an attacker to have Resource Administrator or Administrator privileges to exploit. As of the initial disclosure, there were no known proof of concept exploits or active exploitation in the wild (CERT-EU).

F5 has released patched versions to address this vulnerability: 15.1.0.5, 15.0.1.4, 14.1.2.4, 13.1.3.4, 12.1.5.2, and 11.6.5.2. As a workaround, organizations should secure access to the BIG-IP system to ensure that the TMUI is only accessible by trusted users. Additionally, it is recommended to run all software as a non-privileged user with minimal access rights to limit the immediate consequences of client-side vulnerabilities (CERT-EU).