PT-2019-15777 · F5 · Enterprise Manager+4

Published 2019-12-23 · Updated 2019-12-31 · CVE-2019-19151

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BIG-IP versions 11.5.2 through 15.1.0 BIG-IQ versions 5.0.0 through 7.0.0 iWorkflow version 2.3.0 Enterprise Manager version 3.1.1

Description The issue allows authenticated users with TMOS Shell (tmsh) privileges to access objects on the file system that are normally disallowed by tmsh restrictions. This enables authenticated, low-privileged attackers to access objects on the file system that would not normally be allowed.

Recommendations For BIG-IP versions 11.5.2 through 15.1.0, restrict access to the TMOS Shell (tmsh) to minimize the risk of exploitation. For BIG-IQ versions 5.0.0 through 7.0.0, consider limiting privileges for authenticated users to reduce the attack surface. For iWorkflow version 2.3.0, avoid granting TMOS Shell (tmsh) privileges to low-privileged users until a fix is available. For Enterprise Manager version 3.1.1, restrict access to sensitive objects on the file system to prevent unauthorized access.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2019-19151

Affected Products

Big-Ip

Big-Iq

Enterprise Manager

Tmos Shell

Iworkflow

References · 3

• https://osv.dev/vulnerability/CVE-2019-19151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19151 · Security Note
• https://support.f5.com/csp/article/K21711352 · Vendor Advisory