CVE-2020-5948: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

CVE-2020-5948 is a reflected Cross-Site Scripting (XSS) vulnerability affecting F5 BIG-IP systems. The vulnerability exists in undisclosed endpoints in iControl REST and affects multiple versions including 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2. The vulnerability was disclosed in December 2020 (NVD).

The vulnerability is a reflected XSS attack that targets undisclosed endpoints in the iControl REST API. The CVSS v3.1 base score is 9.6 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), indicating high severity with potential for complete system compromise. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If successfully exploited, this vulnerability could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. The attack requires user interaction and could potentially allow attackers to gain administrative access to the system (NVD).

The vulnerability requires an authenticated user to pass a malicious, specially-crafted URL to the iControl REST API. The attacker needs to discover the weak REST endpoints and get their crafted URL into a context where an F5 REST API user can pass it on in an authenticated context. While the vulnerability requires user interaction, it is rated as having low attack complexity (AttackerKB).

F5 recommends permitting management access to F5 products only over a secure network and limiting access to only trusted users. Organizations should update to the latest security patches for their affected BIG-IP versions (NVD).