Lucene search

K
cve[email protected]CVE-2019-6591
HistoryFeb 05, 2019 - 6:29 p.m.

CVE-2019-6591

2019-02-0518:29:00
CWE-79
web.nvd.nist.gov
22
cve-2019-6591
big-ip apm
14.0.0
13.0.0
12.1.0
nvd
cross-site scripting
xss

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

22.7%

On BIG-IP APM 14.0.0 to 14.0.0.4, 13.0.0 to 13.1.1.3 and 12.1.0 to 12.1.3.7, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.

Affected configurations

NVD
Node
f5big-ip_access_policy_managerRange12.1.012.1.3
OR
f5big-ip_access_policy_managerRange13.0.013.1.1.3
OR
f5big-ip_access_policy_managerRange14.0.014.0.0.4

CNA Affected

[
  {
    "product": "BIG-IP (APM)",
    "vendor": "F5 Networks, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "14.0.0-14.0.0.4, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7"
      }
    ]
  }
]

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

22.7%

Related for CVE-2019-6591