Sign-up

ID

VAR-201903-0195


CVE

CVE-2019-6602


TITLE

plural BIG-IP Vulnerabilities related to security functions in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-003077

DESCRIPTION

In BIG-IP 11.5.1-11.5.8 and 11.6.1-11.6.3, the Configuration Utility login page may not follow best security practices when handling a malicious request. plural BIG-IP The product contains vulnerabilities related to security functions.Information may be obtained. Multiple F5 BIG-IP Products are prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. BIG-IP 11.5.1 through 11.5.8 and 11.6.1 through 11.6.3 are vulnerable. F5 BIG-IP is an application delivery platform integrated with network traffic management, application security management, load balancing and other functions of the US company F5. Attackers can exploit this vulnerability to obtain sensitive information

Trust: 1.98

sources: NVD: CVE-2019-6602 // JVNDB: JVNDB-2019-003077 // BID: 107626 // VULHUB: VHN-158037

AFFECTED PRODUCTS

vendor:f5model:big-ip analyticsscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.6.3

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.8

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.5.1

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application acceleration managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip policy enforcement managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope: - version: -

Trust: 0.8

vendor:f5model:big-ip webacceleratorscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip pemscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip ltmscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip link controllerscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip link controllerscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip link controllerscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip gtmscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip fpsscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip fpsscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip fpsscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip edge gatewayscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip dnsscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip asmscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip apmscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip analyticsscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.6

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip afmscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.6.3

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.6.2

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.6.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.8

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.7

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.5

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.3

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.2

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.1

Trust: 0.3

vendor:f5model:big-ip aamscope:eqversion:11.5.4

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip webacceleratorscope:neversion:11.5.9

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip pemscope:neversion:11.5.9

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip ltmscope:neversion:11.5.9

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip link controllerscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip gtmscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip gtmscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip fpsscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip fpsscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip dnsscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip dnsscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip asmscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip apmscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip analyticsscope:neversion:11.5.9

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip afmscope:neversion:11.5.9

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:12.0

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.6.4

Trust: 0.3

vendor:f5model:big-ip aamscope:neversion:11.5.9

Trust: 0.3

sources: BID: 107626 // JVNDB: JVNDB-2019-003077 // NVD: CVE-2019-6602

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6602
value: HIGH

Trust: 1.0

NVD: CVE-2019-6602
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201903-860
value: HIGH

Trust: 0.6

VULHUB: VHN-158037
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-6602
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-158037
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6602
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-158037 // JVNDB: JVNDB-2019-003077 // CNNVD: CNNVD-201903-860 // NVD: CVE-2019-6602

PROBLEMTYPE DATA

problemtype:CWE-203

Trust: 1.1

problemtype:CWE-254

Trust: 0.9

sources: VULHUB: VHN-158037 // JVNDB: JVNDB-2019-003077 // NVD: CVE-2019-6602

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201903-860

TYPE

security feature problem

Trust: 0.6

sources: CNNVD: CNNVD-201903-860

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-003077

PATCH
title:K11818407url:https://support.f5.com/csp/article/K11818407
Trust: 0.8
title:F5 BIG-IP Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90342
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-003077 // 
            
            
            
            CNNVD: CNNVD-201903-860

EXTERNAL IDS
db:NVDid:CVE-2019-6602
Trust: 2.8
db:BIDid:107626
Trust: 2.0
db:JVNDBid:JVNDB-2019-003077
Trust: 0.8
db:CNNVDid:CNNVD-201903-860
Trust: 0.7
db:VULHUBid:VHN-158037
Trust: 0.1
sources:
            
            
            VULHUB: VHN-158037 // 
            
            
            
            BID: 107626 // 
            
            
            
            JVNDB: JVNDB-2019-003077 // 
            
            
            
            CNNVD: CNNVD-201903-860 // 
            
            
            
            NVD: CVE-2019-6602

REFERENCES
url:http://www.securityfocus.com/bid/107626
Trust: 2.3
url:https://support.f5.com/csp/article/k11818407
Trust: 2.0
url:https://nvd.nist.gov/vuln/detail/cve-2019-6602
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6602
Trust: 0.8
url:https://vigilance.fr/vulnerability/f5-big-ip-information-disclosure-via-rest-framework-login-page-28814
Trust: 0.6
url:http://www.f5.com/products/big-ip/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-158037 // 
            
            
            
            BID: 107626 // 
            
            
            
            JVNDB: JVNDB-2019-003077 // 
            
            
            
            CNNVD: CNNVD-201903-860 // 
            
            
            
            NVD: CVE-2019-6602

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 107626

SOURCES
db:VULHUBid:VHN-158037
db:BIDid:107626
db:JVNDBid:JVNDB-2019-003077
db:CNNVDid:CNNVD-201903-860
db:NVDid:CVE-2019-6602

LAST UPDATE DATE
2024-11-23T22:55:39.146000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-158037date:2020-08-24T00:00:00
db:BIDid:107626date:2019-03-21T00:00:00
db:JVNDBid:JVNDB-2019-003077date:2019-05-09T00:00:00
db:CNNVDid:CNNVD-201903-860date:2020-08-25T00:00:00
db:NVDid:CVE-2019-6602date:2024-11-21T04:46:47.080

SOURCES RELEASE DATE
db:VULHUBid:VHN-158037date:2019-03-28T00:00:00
db:BIDid:107626date:2019-03-21T00:00:00
db:JVNDBid:JVNDB-2019-003077date:2019-05-09T00:00:00
db:CNNVDid:CNNVD-201903-860date:2019-03-22T00:00:00
db:NVDid:CVE-2019-6602date:2019-03-28T21:29:00.600