Vulnerability in F5 Big-Ip Access Policy Manager
CVE-2019-6642
In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.
EPSS: 0.018 (77.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- F5 Big-ip_access_policy_manager — versions 15.0.0
- F5 Big-ip_advanced_firewall_manager — versions 15.0.0
- F5 Big-ip_analytics — versions 15.0.0
- F5 Big-ip_application_acceleration_manager — versions 15.0.0
- F5 Big-ip_application_security_manager — versions 15.0.0
- F5 Big-ip, Big-iq, Iworkflow, Enterprise Manager — versions BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5
- F5 Big-ip_domain_name_system — versions 15.0.0
- F5 Big-ip_edge_gateway — versions 15.0.0
- F5 Big-ip_fraud_protection_service — versions 15.0.0
- F5 Big-ip_global_traffic_manager — versions 15.0.0
References
- f5sirt@f5.com (x_refsource_CONFIRM, Vendor Advisory)
- f5sirt@f5.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2019-6642?
- CVE-2019-6642 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager. CVSS score: 8.8/10. Published 2019-07-01.
- How severe is CVE-2019-6642?
- High severity. CVSS v3 base score is 8.8 out of 10.