ID

VAR-201909-0076


CVE

CVE-2019-6649


TITLE

plural F5 BIG-IP Information disclosure vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-010088

DESCRIPTION

F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings. plural F5 BIG-IP The product contains an information disclosure vulnerability.Information may be obtained and information may be altered. Both F5 BIG-IP and F5 Enterprise Manager are products of the US company F5. F5 BIG-IP is an application delivery platform that integrates functions such as network traffic management, application security management, and load balancing. F5 Enterprise Manager is a tool that provides visibility into the entire BIG-IP application delivery infrastructure and optimizes application performance. Security vulnerabilities exist in F5 BIG-IP and F5 Enterprise Manager. An attacker could exploit this vulnerability to disclose sensitive information and modify system configurations. The following products and versions are affected: F5 BIG-IP version 15.0.0, version 14.1.0 to version 14.1.0.6, version 14.0.0 to version 14.0.0.5, version 13.0.0 to version 13.1.1.5, version 12.1.0 to version 12.1.4.1, version 11.6.0 to version 11.6.4, version 11.5.1 to version 11.5.9; Enterprise Manager version 3.1.1

Trust: 1.71

sources: NVD: CVE-2019-6649 // JVNDB: JVNDB-2019-010088 // VULHUB: VHN-158084

AFFECTED PRODUCTS

vendor:f5model:big-ip domain name systemscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip link controllerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip link controllerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip application security managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip enterprise managerscope:eqversion:3.1.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip global traffic managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip analyticsscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip application security managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip link controllerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip link controllerscope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:lteversion:11.6.4

Trust: 1.0

vendor:f5model:big-ip fraud protection servicescope:lteversion:11.5.9

Trust: 1.0

vendor:f5model:big-ip edge gatewayscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:gteversion:12.1.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip local traffic managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.6.1

Trust: 1.0

vendor:f5model:big-ip analyticsscope:lteversion:12.1.4

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip analyticsscope:gteversion:11.5.2

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:eqversion:14.0.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip policy enforcement managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip domain name systemscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip application acceleration managerscope:lteversion:13.1.1

Trust: 1.0

vendor:f5model:big-ip advanced firewall managerscope:eqversion:15.0.0

Trust: 1.0

vendor:f5model:big-ip application security managerscope:gteversion:13.1.0

Trust: 1.0

vendor:f5model:big-ip webacceleratorscope:eqversion:14.1.0

Trust: 1.0

vendor:f5model:big-ip access policy managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip advanced firewall managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip analyticsscope: - version: -

Trust: 0.8

vendor:f5model:big-ip application security managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip domain name systemscope: - version: -

Trust: 0.8

vendor:f5model:big-ip edge gatewayscope: - version: -

Trust: 0.8

vendor:f5model:big-ip fraud protection servicescope: - version: -

Trust: 0.8

vendor:f5model:big-ip global traffic managerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip link controllerscope: - version: -

Trust: 0.8

vendor:f5model:big-ip local traffic managerscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-010088 // NVD: CVE-2019-6649

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6649
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-6649
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201909-1011
value: CRITICAL

Trust: 0.6

VULHUB: VHN-158084
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-6649
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-158084
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6649
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2019-6649
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-158084 // JVNDB: JVNDB-2019-010088 // CNNVD: CNNVD-201909-1011 // NVD: CVE-2019-6649

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-200

Trust: 0.9

sources: VULHUB: VHN-158084 // JVNDB: JVNDB-2019-010088 // NVD: CVE-2019-6649

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-1011

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201909-1011

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-010088

PATCH

title:K05123525url:https://support.f5.com/csp/article/K05123525

Trust: 0.8

title:F5 BIG-IP and F5 Enterprise Manager Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98477

Trust: 0.6

sources: JVNDB: JVNDB-2019-010088 // CNNVD: CNNVD-201909-1011

EXTERNAL IDS

db:NVDid:CVE-2019-6649

Trust: 2.5

db:JVNDBid:JVNDB-2019-010088

Trust: 0.8

db:CNNVDid:CNNVD-201909-1011

Trust: 0.7

db:CNVDid:CNVD-2020-61643

Trust: 0.1

db:VULHUBid:VHN-158084

Trust: 0.1

sources: VULHUB: VHN-158084 // JVNDB: JVNDB-2019-010088 // CNNVD: CNNVD-201909-1011 // NVD: CVE-2019-6649

REFERENCES

url:https://support.f5.com/csp/article/k05123525

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2019-6649

Trust: 1.4

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6649

Trust: 0.8

url:https://vigilance.fr/vulnerability/f5-big-ip-configuration-corruption-via-configsync-30371

Trust: 0.6

sources: VULHUB: VHN-158084 // JVNDB: JVNDB-2019-010088 // CNNVD: CNNVD-201909-1011 // NVD: CVE-2019-6649

SOURCES

db:VULHUBid:VHN-158084
db:JVNDBid:JVNDB-2019-010088
db:CNNVDid:CNNVD-201909-1011
db:NVDid:CVE-2019-6649

LAST UPDATE DATE

2024-11-23T22:55:27.885000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-158084date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2019-010088date:2019-10-04T00:00:00
db:CNNVDid:CNNVD-201909-1011date:2020-08-25T00:00:00
db:NVDid:CVE-2019-6649date:2024-11-21T04:46:52.880

SOURCES RELEASE DATE

db:VULHUBid:VHN-158084date:2019-09-20T00:00:00
db:JVNDBid:JVNDB-2019-010088date:2019-10-04T00:00:00
db:CNNVDid:CNNVD-201909-1011date:2019-09-20T00:00:00
db:NVDid:CVE-2019-6649date:2019-09-20T20:15:11.383