Lucene search

[email protected]CVE-2019-6649

HistorySep 20, 2019 - 8:15 p.m.

CVE-2019-6649

2019-09-2020:15:11

[email protected]

web.nvd.nist.gov

308

cve-2019-6649

f5 big-ip

enterprise manager

security vulnerability

information disclosure

system configuration modification

configsync.

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

53.8%

JSON

F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.

Affected configurations

NVD

Node

f5big-ip_application_security_managerRange11.5.2–11.5.9

f5big-ip_application_security_managerRange11.6.1–11.6.4

f5big-ip_application_security_managerRange12.1.0–12.1.4

f5big-ip_application_security_managerRange13.1.0–13.1.1

f5big-ip_application_security_managerMatch14.0.0

f5big-ip_application_security_managerMatch14.1.0

f5big-ip_application_security_managerMatch15.0.0

Node

f5big-ip_local_traffic_managerRange11.5.2–11.5.9

f5big-ip_local_traffic_managerRange11.6.1–11.6.4

f5big-ip_local_traffic_managerRange12.1.0–12.1.4

f5big-ip_local_traffic_managerRange13.1.0–13.1.1

f5big-ip_local_traffic_managerMatch14.0.0

f5big-ip_local_traffic_managerMatch14.1.0

f5big-ip_local_traffic_managerMatch15.0.0

Node

f5big-ip_advanced_firewall_managerRange11.5.2–11.5.9

f5big-ip_advanced_firewall_managerRange11.6.1–11.6.4

f5big-ip_advanced_firewall_managerRange12.1.0–12.1.4

f5big-ip_advanced_firewall_managerRange13.1.0–13.1.1

f5big-ip_advanced_firewall_managerMatch14.0.0

f5big-ip_advanced_firewall_managerMatch14.1.0

f5big-ip_advanced_firewall_managerMatch15.0.0

Node

f5big-ip_analyticsRange11.5.2–11.5.9

f5big-ip_analyticsRange11.6.1–11.6.4

f5big-ip_analyticsRange12.1.0–12.1.4

f5big-ip_analyticsRange13.1.0–13.1.1

f5big-ip_analyticsMatch14.0.0

f5big-ip_analyticsMatch14.1.0

f5big-ip_analyticsMatch15.0.0

Node

f5big-ip_access_policy_managerRange11.5.2–11.5.9

f5big-ip_access_policy_managerRange11.6.1–11.6.4

f5big-ip_access_policy_managerRange12.1.0–12.1.4

f5big-ip_access_policy_managerRange13.1.0–13.1.1

f5big-ip_access_policy_managerMatch14.0.0

f5big-ip_access_policy_managerMatch14.1.0

f5big-ip_access_policy_managerMatch15.0.0

Node

f5big-ip_domain_name_systemRange11.5.2–11.5.9

f5big-ip_domain_name_systemRange11.6.1–11.6.4

f5big-ip_domain_name_systemRange12.1.0–12.1.4

f5big-ip_domain_name_systemRange13.1.0–13.1.1

f5big-ip_domain_name_systemMatch14.0.0

f5big-ip_domain_name_systemMatch14.1.0

f5big-ip_domain_name_systemMatch15.0.0

Node

f5big-ip_edge_gatewayRange11.5.2–11.5.9

f5big-ip_edge_gatewayRange11.6.1–11.6.4

f5big-ip_edge_gatewayRange12.1.0–12.1.4

f5big-ip_edge_gatewayRange13.1.0–13.1.1

f5big-ip_edge_gatewayMatch14.0.0

f5big-ip_edge_gatewayMatch14.1.0

f5big-ip_edge_gatewayMatch15.0.0

Node

f5big-ip_fraud_protection_serviceRange11.5.2–11.5.9

f5big-ip_fraud_protection_serviceRange11.6.1–11.6.4

f5big-ip_fraud_protection_serviceRange12.1.0–12.1.4

f5big-ip_fraud_protection_serviceRange13.1.0–13.1.1

f5big-ip_fraud_protection_serviceMatch14.0.0

f5big-ip_fraud_protection_serviceMatch14.1.0

f5big-ip_fraud_protection_serviceMatch15.0.0

Node

f5big-ip_global_traffic_managerRange11.5.2–11.5.9

f5big-ip_global_traffic_managerRange11.6.1–11.6.4

f5big-ip_global_traffic_managerRange12.1.0–12.1.4

f5big-ip_global_traffic_managerRange13.1.0–13.1.1

f5big-ip_global_traffic_managerMatch14.0.0

f5big-ip_global_traffic_managerMatch14.1.0

f5big-ip_global_traffic_managerMatch15.0.0

Node

f5big-ip_link_controllerRange11.5.2–11.5.9

f5big-ip_link_controllerRange11.6.1–11.6.4

f5big-ip_link_controllerRange12.1.0–12.1.4

f5big-ip_link_controllerRange13.1.0–13.1.1

f5big-ip_link_controllerMatch14.0.0

f5big-ip_link_controllerMatch14.1.0

f5big-ip_link_controllerMatch15.0.0

Node

f5big-ip_policy_enforcement_managerRange11.5.2–11.5.9

f5big-ip_policy_enforcement_managerRange11.6.1–11.6.4

f5big-ip_policy_enforcement_managerRange12.1.0–12.1.4

f5big-ip_policy_enforcement_managerRange13.1.0–13.1.1

f5big-ip_policy_enforcement_managerMatch14.0.0

f5big-ip_policy_enforcement_managerMatch14.1.0

f5big-ip_policy_enforcement_managerMatch15.0.0

Node

f5big-ip_webacceleratorRange11.5.2–11.5.9

f5big-ip_webacceleratorRange11.6.1–11.6.4

f5big-ip_webacceleratorRange12.1.0–12.1.4

f5big-ip_webacceleratorRange13.1.0–13.1.1

f5big-ip_webacceleratorMatch14.0.0

f5big-ip_webacceleratorMatch14.1.0

f5big-ip_webacceleratorMatch15.0.0

Node

f5big-ip_enterprise_managerMatch3.1.1

Node

f5big-ip_application_acceleration_managerRange11.5.2–11.5.9

f5big-ip_application_acceleration_managerRange11.6.1–11.6.4

f5big-ip_application_acceleration_managerRange12.1.0–12.1.4

f5big-ip_application_acceleration_managerRange13.1.0–13.1.1

f5big-ip_application_acceleration_managerMatch14.0.0

f5big-ip_application_acceleration_managerMatch14.1.0

f5big-ip_application_acceleration_managerMatch15.0.0

CPENameOperatorVersion
f5:big-ip_application_security_managerf5 big-ip application security managerle11.5.9
f5:big-ip_application_security_managerf5 big-ip application security managerle11.6.4
f5:big-ip_application_security_managerf5 big-ip application security managerle12.1.4
f5:big-ip_application_security_managerf5 big-ip application security managerle13.1.1
f5:big-ip_application_security_managerf5 big-ip application security managereq14.0.0
f5:big-ip_application_security_managerf5 big-ip application security managereq14.1.0
f5:big-ip_application_security_managerf5 big-ip application security managereq15.0.0

CPE	Name	Operator	Version
f5:big-ip_application_security_manager	f5 big-ip application security manager	le	11.5.9
f5:big-ip_application_security_manager	f5 big-ip application security manager	le	11.6.4
f5:big-ip_application_security_manager	f5 big-ip application security manager	le	12.1.4
f5:big-ip_application_security_manager	f5 big-ip application security manager	le	13.1.1
f5:big-ip_application_security_manager	f5 big-ip application security manager	eq	14.0.0
f5:big-ip_application_security_manager	f5 big-ip application security manager	eq	14.1.0
f5:big-ip_application_security_manager	f5 big-ip application security manager	eq	15.0.0

CNA Affected

[
  {
    "product": "BIG-IP, Enterprise Manager",
    "vendor": "F5 Networks",
    "versions": [
      {
        "status": "affected",
        "version": "BIG-IP 15.0.0"
      },
      {
        "status": "affected",
        "version": "14.1.0-14.1.0.6"
      },
      {
        "status": "affected",
        "version": "14.0.0-14.0.0.5"
      },
      {
        "status": "affected",
        "version": "13.0.0-13.1.1.5"
      },
      {
        "status": "affected",
        "version": "12.1.0-12.1.4.1"
      },
      {
        "status": "affected",
        "version": "11.6.0-11.6.4"
      },
      {
        "status": "affected",
        "version": "11.5.1-11.5.9"
      },
      {
        "status": "affected",
        "version": "EM 3.1.1"
      }
    ]
  }
]

References

support.f5.com/csp/article/K05123525

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9 High

AI Score

Confidence

High

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

53.8%

JSON

Related for CVE-2019-6649

cvelist1 prion1 osv1 nessus1 nvd1 f51