CVE-2019-19151
published 2019-12-23CVE-2019-19151: On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0…
PriorityP427medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.30%
22.0th percentile
On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to access objects on the file system which would not normally be allowed.
Affected
86 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | 11.5.1 – 11.6.5 | — |
| f5 | big-ip_access_policy_manager | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_access_policy_manager | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_access_policy_manager | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_access_policy_manager | 15.0.0 – 15.1.0 | — |
| f5 | big-ip_advanced_firewall_manager | 11.5.1 – 11.6.5 | — |
| f5 | big-ip_advanced_firewall_manager | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_advanced_firewall_manager | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_advanced_firewall_manager | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_advanced_firewall_manager | 15.0.0 – 15.1.0 | — |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 11.5.1 – 11.6.5 | — |
| f5 | big-ip_analytics | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_analytics | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_analytics | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_analytics | 15.0.0 – 15.1.0 | — |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 11.5.1 – 11.6.5 | — |
| f5 | big-ip_application_acceleration_manager | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_application_acceleration_manager | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_application_acceleration_manager | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_application_acceleration_manager | 15.0.0 – 15.1.0 | — |
| f5 | big-ip_application_security_manager | 11.5.1 – 11.6.5 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5mqv-m2p9-qprh: On BIG-IP versions 15
ghsa_unreviewed·2022-05-24
CVE-2019-19151 [MEDIUM] CWE-269 GHSA-5mqv-m2p9-qprh: On BIG-IP versions 15
On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to access objects on the file system which would not normally be allowed.
F5
CVE-2019-19151: On BIG-IP versions 15
vendor_f5·2019-12-23·CVSS 5.5
CVE-2019-19151 [MEDIUM] CWE-269 CVE-2019-19151: On BIG-IP versions 15
CVE-2019-19151: On BIG-IP versions 15
On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to access objects on the file system which would not normally be allowed.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Analytics, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP WebAccelerator, BIG-IQ, Enterprise Manager, Iworkflow
Af
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-12-23
Published