CVE-2019-6663
published 2019-11-15CVE-2019-6663: The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0…
PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCNIHAN
EPSS
0.65%
47.0th percentile
The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack.
Affected
86 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| f5 | big-ip_aam | — | — |
| f5 | big-ip_access_policy_manager | 11.5.2 – 11.6.5 | — |
| f5 | big-ip_access_policy_manager | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_access_policy_manager | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_access_policy_manager | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_access_policy_manager | 15.0.0 – 15.0.1 | — |
| f5 | big-ip_advanced_firewall_manager | 11.5.2 – 11.6.5 | — |
| f5 | big-ip_advanced_firewall_manager | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_advanced_firewall_manager | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_advanced_firewall_manager | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_advanced_firewall_manager | 15.0.0 – 15.0.1 | — |
| f5 | big-ip_afm | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_analytics | 11.5.2 – 11.6.5 | — |
| f5 | big-ip_analytics | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_analytics | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_analytics | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_analytics | 15.0.0 – 15.0.1 | — |
| f5 | big-ip_apm | — | — |
| f5 | big-ip_application_acceleration_manager | 11.5.2 – 11.6.5 | — |
| f5 | big-ip_application_acceleration_manager | 12.1.0 – 12.1.5 | — |
| f5 | big-ip_application_acceleration_manager | 13.0.0 – 13.1.3 | — |
| f5 | big-ip_application_acceleration_manager | 14.0.0 – 14.1.2 | — |
| f5 | big-ip_application_acceleration_manager | 15.0.0 – 15.0.1 | — |
| f5 | big-ip_application_security_manager | 11.5.2 – 11.6.5 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
F5
CVE-2019-6663: The BIG-IP 15
vendor_f5·2019-11-15·CVSS 5.5
CVE-2019-6663 [MEDIUM] CWE-20 CVE-2019-6663: The BIG-IP 15
CVE-2019-6663: The BIG-IP 15
The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack.
Affected Products: BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP Analytics, BIG-IP DNS, BIG-IP Edge Gateway, BIG-IP FPS, BIG-IP GTM, BIG-IP LTM, BIG-IP Link Controller, BIG-IP PEM, BIG-IP WebAccelerator, BIG-IQ, Enterprise Manager, Iworkflow
Affected Versions: 11.5.2 - 11.6.5; 12.1.0 - 12.1.5; 13.0.0 - 13.1.3; 14.0.0 - 14.1.2; 15.0.0 - 15.0.1; 2.3.0; 3.1.1; 5.2.0 - 5.4.0; 6.0.0 - 6.1.0; 7.0.0
F5 Advisory Articles: K76052144
F5 References: https://support.f5.com/csp/article/K76052144
GHSA
GHSA-2x5q-fj99-48h5: The BIG-IP 15
ghsa_unreviewed·2022-05-24
CVE-2019-6663 [MEDIUM] GHSA-2x5q-fj99-48h5: The BIG-IP 15
The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-11-15
Published