PT-2019-15777 · F5 · Enterprise Manager+4

Publicado 2019-12-23 · Atualizado 2019-12-31 · CVE-2019-19151

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.5.2 through 15.1.0 BIG-IQ versions 5.0.0 through 7.0.0 iWorkflow version 2.3.0 Enterprise Manager version 3.1.1

Description The issue allows authenticated users with TMOS Shell (tmsh) privileges to access objects on the file system that are normally disallowed by tmsh restrictions. This enables authenticated, low-privileged attackers to access objects on the file system that would not normally be allowed.

Recommendations For BIG-IP versions 11.5.2 through 15.1.0, restrict access to the TMOS Shell (tmsh) to minimize the risk of exploitation. For BIG-IQ versions 5.0.0 through 7.0.0, consider limiting privileges for authenticated users to reduce the attack surface. For iWorkflow version 2.3.0, avoid granting TMOS Shell (tmsh) privileges to low-privileged users until a fix is available. For Enterprise Manager version 3.1.1, restrict access to sensitive objects on the file system to prevent unauthorized access.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2019-19151

Produtos afetados

Big-Ip

Big-Iq

Enterprise Manager

Tmos Shell

Iworkflow

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-19151 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19151 · Nota de Segurança
• https://support.f5.com/csp/article/K21711352 · Aviso do Fabricante