CVE-2020-5928

LOW 3.1CVE-2020-5928 · Published 26/08/2020 · updated 17/06/2026

In short

CVE-2020-5928 is a LOW (CVSS 3.1) vulnerability affecting big-ip application security manager (f5).
Chance of exploitation in the next 30 days (EPSS): 0.18%, higher than 7.8% of all vulnerabilities.
Fix: update to 11.6.5, 12.1.5.2, 13.1.3, 14.1.2.7 or later.

Package	Affected versions	Patched versions
big-ip application security manager f5	`≥ 11.5.2, < 11.6.5≥ 12.1.0, < 12.1.5.2≥ 13.1.0, < 13.1.3≥ 14.1.0, < 14.1.2.7≥ 15.0.0, < 15.0.1.4≥ 15.1.0, < 15.1.0.5`	`11.6.512.1.5.213.1.314.1.2.715.0.1.415.1.0.5`

Description

In versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, 13.1.0-13.1.3.4, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, BIG-IP ASM Configuration utility CSRF protection token can be reused multiple times.

References

support.f5.com/csp/article/K40843345 · Vendor Advisory

More vulnerabilities in big-ip application security manager

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

big-ip application security manager

≥ 11.5.2, < 11.6.5≥ 12.1.0, < 12.1.5.2≥ 13.1.0, < 13.1.3≥ 14.1.0, < 14.1.2.7≥ 15.0.0, < 15.0.1.4≥ 15.1.0, < 15.1.0.5

11.6.512.1.5.213.1.314.1.2.715.0.1.415.1.0.5

More vulnerabilities in big-ip application security manager

See all →