PT-2019-18233 · F5 · F5 Big-Iq+3

Published 2019-09-25 · Updated 2023-02-03 · CVE-2019-6651

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 15.0.0, 14.1.0 through 14.1.0.6, 14.0.0 through 14.0.0.5, 13.0.0 through 13.1.1.5, 12.1.0 through 12.1.4.1, 11.5.1 through 11.6.4 F5 BIG-IQ versions 7.0.0, 6.0.0 through 6.1.0, 5.2.0 through 5.4.0 F5 iWorkflow version 2.3.0 F5 Enterprise Manager version 3.1.1

Description The Configuration utility login page may not follow best security practices when handling a malicious request.

Recommendations For F5 BIG-IP versions 15.0.0, 14.1.0 through 14.1.0.6, 14.0.0 through 14.0.0.5, 13.0.0 through 13.1.1.5, 12.1.0 through 12.1.4.1, 11.5.1 through 11.6.4, consider updating to a version that addresses the security issue. For F5 BIG-IQ versions 7.0.0, 6.0.0 through 6.1.0, 5.2.0 through 5.4.0, consider updating to a version that addresses the security issue. For F5 iWorkflow version 2.3.0, consider updating to a version that addresses the security issue. For F5 Enterprise Manager version 3.1.1, consider updating to a version that addresses the security issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2019-6651

Affected Products

F5 Big-Ip

F5 Big-Iq

F5 Enterprise Manager

F5 Iworkflow

References · 4

• https://support.f5.com/csp/article/K89509323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6651 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6651 · Vendor Advisory
• https://support.f5.com/csp/article/K89509323?utm_source=f5support&amp%3Butm_medium=RSS · Note