PT-2019-18182 · F5 · F5 Big-Ip

Published 2019-03-13 · Updated 2023-02-16 · CVE-2019-6600

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.1 through 11.5.8 F5 BIG-IP versions 11.6.1 through 11.6.3.2 F5 BIG-IP versions 12.1.0 through 12.1.3.7 F5 BIG-IP versions 13.0.0 through 13.1.1.3 F5 BIG-IP versions 14.0.0 through 14.0.0.2

Description When remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.

Recommendations For F5 BIG-IP versions 11.5.1 through 11.5.8, update to a version that sanitizes user input to prevent cross-site scripting attacks. For F5 BIG-IP versions 11.6.1 through 11.6.3.2, update to a version that sanitizes user input to prevent cross-site scripting attacks. For F5 BIG-IP versions 12.1.0 through 12.1.3.7, update to a version that sanitizes user input to prevent cross-site scripting attacks. For F5 BIG-IP versions 13.0.0 through 13.1.1.3, update to a version that sanitizes user input to prevent cross-site scripting attacks. For F5 BIG-IP versions 14.0.0 through 14.0.0.2, update to a version that sanitizes user input to prevent cross-site scripting attacks. As a temporary workaround, consider restricting access to the login page for unauthenticated clients until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-6600

Affected Products

F5 Big-Ip

References · 5

• https://osv.dev/vulnerability/CVE-2019-6600 · Vendor Advisory
• https://support.f5.com/csp/article/K23734425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6600 · Security Note
• https://t.me/cvenotify/44432 · Telegram Post
• http://securityfocus.com/bid/107470 · Note