Traffic Management User Interface Vulnerability in F5 BIG-IP
CVE-2019-6598

4.3MEDIUM

Key Information:

Vendor
F5
Status
Big-ip (ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Edge Gateway, Gtm, Link Controller, Pem, Webaccelerator, Websafe); Enterprise Manager
Vendor
CVE Published:
11 March 2019

Summary

In the F5 BIG-IP version range of 11.5.1 to 14.0.0.2, a vulnerability exists in the Traffic Management User Interface (TMUI) that allows authenticated users to submit malformed requests. This can lead to a disruption of TMUI services. Users with any role except the No Access role can exploit this vulnerability, as they possess sufficient access rights to perform the attack on the TMUI.

Affected Version(s)

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe); Enterprise Manager 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, 11.5.1-11.5.8

BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator, WebSafe); Enterprise Manager EM 3.1.1

References

https://support.f5.com/csp/article/K44603900
x_refsource_CONFIRM

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.