CVE-2019-6639

Published: Jul 3, 2019Modified: Nov 21, 2024

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

On BIG-IP (AFM, PEM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.1-11.5.8, an undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting (XSS) issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the XSS.

Affected (12)

Products: F5: Big Ip Advanced Firewall Manager, Big Ip Policy Enforcement Manager

2 products

Big Ip Advanced Firewall Manager

Big Ip Policy Enforcement Manager

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Advanced Firewall Manager	From 11.5.0 to 11.5.9
F5 Big Ip Advanced Firewall Manager	From 11.6.0 to 11.6.4
F5 Big Ip Advanced Firewall Manager	From 12.1.0 to 12.1.4.1
F5 Big Ip Advanced Firewall Manager	From 13.0.0 to 13.1.1.5
F5 Big Ip Advanced Firewall Manager	From 14.0.0 to 14.0.0.5
F5 Big Ip Advanced Firewall Manager	From 14.1.0 to 14.1.0.6

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Policy Enforcement Manager	From 11.5.0 to 11.5.9
F5 Big Ip Policy Enforcement Manager	From 11.6.0 to 11.6.4
F5 Big Ip Policy Enforcement Manager	From 12.1.0 to 12.1.4.1
F5 Big Ip Policy Enforcement Manager	From 13.0.0 to 13.1.1.5
F5 Big Ip Policy Enforcement Manager	From 14.0.0 to 14.0.0.5
F5 Big Ip Policy Enforcement Manager	From 14.1.0 to 14.1.0.6