Command Restriction Flaw in BIG-IP Configuration Utility by F5 Networks
CVE-2019-6597

7.2HIGH

Key Information:

Vendor
F5
Status
Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Fps, Gtm, Link Controller, Pem, Webaccelerator); Enterprise Manager
Vendor
CVE Published:
11 March 2019

Summary

A command restriction flaw exists in F5 Networks’ BIG-IP where authenticated administrative users can execute unauthorized commands through the Traffic Management User Interface (TMUI). This vulnerability may lead to unintended administrative access and manipulation of system settings, compromising the security posture of the application and potentially exposing sensitive data or configurations.

Affected Version(s)

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator); Enterprise Manager 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, 11.5.1-11.5.8

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator); Enterprise Manager EM 3.1.1

References

https://support.f5.com/csp/article/K29280193
x_refsource_CONFIRM

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.