K01049383 : BIG-IP restjavad vulnerability CVE-2019-6662

Security Advisory Description

Sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data. (CVE-2019-6662)

Impact

When logging invalid requests, such as HTTP code 400 errors, the restjavadprocess includes the request body in the log message. During authentication operations, the request body includes credentials and potentially other sensitive data, which is propagated to the log. No information is directly exposed, and attacks will not be able to take control when 400 errors occur, but when the system is in a state in which processing errors occur, sensitive data may be logged. Users with access to logs will be able to view that data.