CVE-2019-6600
published 2019-03-13CVE-2019-6600: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.24%
69.0th percentile
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
Affected
78 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | 11.5.1 – 11.5.8 | — |
| f5 | big-ip_access_policy_manager | 11.6.1 – 11.6.3.2 | — |
| f5 | big-ip_access_policy_manager | 12.1.0 – 12.1.3.7 | — |
| f5 | big-ip_access_policy_manager | 13.0.0 – 13.1.1.3 | — |
| f5 | big-ip_access_policy_manager | 14.0.0 – 14.0.0.2 | — |
| f5 | big-ip_advanced_firewall_manager | 11.5.1 – 11.5.8 | — |
| f5 | big-ip_advanced_firewall_manager | 11.6.1 – 11.6.3.2 | — |
| f5 | big-ip_advanced_firewall_manager | 12.1.0 – 12.1.3.7 | — |
| f5 | big-ip_advanced_firewall_manager | 13.0.0 – 13.1.1.3 | — |
| f5 | big-ip_advanced_firewall_manager | 14.0.0 – 14.0.0.2 | — |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 11.5.1 – 11.5.8 | — |
| f5 | big-ip_analytics | 11.6.1 – 11.6.3.2 | — |
| f5 | big-ip_analytics | 12.1.0 – 12.1.3.7 | — |
| f5 | big-ip_analytics | 13.0.0 – 13.1.1.3 | — |
| f5 | big-ip_analytics | 14.0.0 – 14.0.0.2 | — |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 11.5.1 – 11.5.8 | — |
| f5 | big-ip_application_acceleration_manager | 11.6.1 – 11.6.3.2 | — |
| f5 | big-ip_application_acceleration_manager | 12.1.0 – 12.1.3.7 | — |
| f5 | big-ip_application_acceleration_manager | 13.0.0 – 13.1.1.3 | — |
| f5 | big-ip_application_acceleration_manager | 14.0.0 – 14.0.0.2 | — |
| f5 | big-ip_application_security_manager | 11.5.1 – 11.5.8 | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2019-6600: In BIG-IP 14
vendor_f5·2019-03-13·CVSS 6.1
CVE-2019-6600 [MEDIUM] CWE-79 CVE-2019-6600: In BIG-IP 14
CVE-2019-6600: In BIG-IP 14
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Analytics, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP WebAccelerator
Affected Versions: 11.5.1 - 11.5.8; 11.6.1 - 11.6.3.2; 12.1.0 - 12.1.3.7; 13.0.0 - 13.1.1.3; 14.0.0 - 14.0.0.2
F5 Advisory Articles: K23734425
F5 References: https://support.f5.com/csp/article/K23
GHSA
GHSA-q48m-537g-pxq7: In BIG-IP 14
ghsa_unreviewed·2022-05-14
CVE-2019-6600 [MEDIUM] CWE-79 GHSA-q48m-537g-pxq7: In BIG-IP 14
In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-03-13
Published