Vulnerabilities > CVE-2019-6646 - Unspecified vulnerability in F5 products

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

nessus

NVD

Published: 2019-09-04

Updated: 2020-08-24

Summary

On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges.

Vulnerable Configurations

Part	Description	Count
Application	F5 F5 BIG IP Local Traffic Manager 12.0.0 F5 BIG IP Local Traffic Manager 11.5.2 F5 BIG IP Local Traffic Manager 11.5.3 F5 BIG IP Local Traffic Manager 11.5.4 F5 BIG IP Local Traffic Manager 11.5.4.1 F5 BIG IP Local Traffic Manager 11.5.4.2 F5 BIG IP Local Traffic Manager 11.5.4.2.74.291 F5 BIG IP Local Traffic Manager 11.5.4.3 F5 BIG IP Local Traffic Manager 11.5.4.4 F5 BIG IP Local Traffic Manager 11.5.5 F5 BIG IP Local Traffic Manager 11.5.6 F5 BIG IP Local Traffic Manager 11.5.7 F5 BIG IP Local Traffic Manager 11.5.8 F5 BIG IP Local Traffic Manager 11.5.9 F5 BIG IP Local Traffic Manager 11.5.10 F5 BIG IP Local Traffic Manager 11.6.0 F5 BIG IP Local Traffic Manager 11.6.1 F5 BIG IP Local Traffic Manager 11.6.2 F5 BIG IP Local Traffic Manager 11.6.3 F5 BIG IP Local Traffic Manager 11.6.3.1 F5 BIG IP Local Traffic Manager 11.6.3.2 F5 BIG IP Local Traffic Manager 11.6.3.3 F5 BIG IP Local Traffic Manager 11.6.3.4 F5 BIG IP Local Traffic Manager 11.6.4 F5 BIG IP Policy Enforcement Manager 12.0.0 F5 BIG IP Policy Enforcement Manager 11.5.2 F5 BIG IP Policy Enforcement Manager 11.5.3 F5 BIG IP Policy Enforcement Manager 11.5.4 F5 BIG IP Policy Enforcement Manager 11.5.4.1 F5 BIG IP Policy Enforcement Manager 11.5.4.2 F5 BIG IP Policy Enforcement Manager 11.5.4.2.74.291 F5 BIG IP Policy Enforcement Manager 11.5.4.3 F5 BIG IP Policy Enforcement Manager 11.5.4.4 F5 BIG IP Policy Enforcement Manager 11.5.5 F5 BIG IP Policy Enforcement Manager 11.5.6 F5 BIG IP Policy Enforcement Manager 11.5.7 F5 BIG IP Policy Enforcement Manager 11.5.8 F5 BIG IP Policy Enforcement Manager 11.5.9 F5 BIG IP Policy Enforcement Manager 11.5.10 F5 BIG IP Policy Enforcement Manager 11.6.0 F5 BIG IP Policy Enforcement Manager 11.6.1 F5 BIG IP Policy Enforcement Manager 11.6.2 F5 BIG IP Policy Enforcement Manager 11.6.3 F5 BIG IP Policy Enforcement Manager 11.6.3.1 F5 BIG IP Policy Enforcement Manager 11.6.3.2 F5 BIG IP Policy Enforcement Manager 11.6.3.3 F5 BIG IP Policy Enforcement Manager 11.6.3.4 F5 BIG IP Policy Enforcement Manager 11.6.4 F5 BIG IP Application Acceleration Manager 12.0.0 F5 BIG IP Application Acceleration Manager 11.5.2 F5 BIG IP Application Acceleration Manager 11.5.3 F5 BIG IP Application Acceleration Manager 11.5.4 F5 BIG IP Application Acceleration Manager 11.5.4.1 F5 BIG IP Application Acceleration Manager 11.5.4.2 F5 BIG IP Application Acceleration Manager 11.5.4.2.74.291 F5 BIG IP Application Acceleration Manager 11.5.4.3 F5 BIG IP Application Acceleration Manager 11.5.4.4 F5 BIG IP Application Acceleration Manager 11.5.5 F5 BIG IP Application Acceleration Manager 11.5.6 F5 BIG IP Application Acceleration Manager 11.5.7 F5 BIG IP Application Acceleration Manager 11.5.8 F5 BIG IP Application Acceleration Manager 11.5.9 F5 BIG IP Application Acceleration Manager 11.5.10 F5 BIG IP Application Acceleration Manager 11.6.0 F5 BIG IP Application Acceleration Manager 11.6.1 F5 BIG IP Application Acceleration Manager 11.6.2 F5 BIG IP Application Acceleration Manager 11.6.3 F5 BIG IP Application Acceleration Manager 11.6.3.1 F5 BIG IP Application Acceleration Manager 11.6.3.2 F5 BIG IP Application Acceleration Manager 11.6.3.3 F5 BIG IP Application Acceleration Manager 11.6.3.4 F5 BIG IP Application Acceleration Manager 11.6.4 F5 BIG IP Access Policy Manager 12.0.0 F5 BIG IP Access Policy Manager 11.5.2 F5 BIG IP Access Policy Manager 11.5.3 F5 BIG IP Access Policy Manager 11.5.4 F5 BIG IP Access Policy Manager 11.5.4.1 F5 BIG IP Access Policy Manager 11.5.4.2 F5 BIG IP Access Policy Manager 11.5.4.2.74.291 F5 BIG IP Access Policy Manager 11.5.4.3 F5 BIG IP Access Policy Manager 11.5.4.4 F5 BIG IP Access Policy Manager 11.5.5 F5 BIG IP Access Policy Manager 11.5.6 F5 BIG IP Access Policy Manager 11.5.7 F5 BIG IP Access Policy Manager 11.5.8 F5 BIG IP Access Policy Manager 11.5.9 F5 BIG IP Access Policy Manager 11.5.10 F5 BIG IP Access Policy Manager 11.6.0 F5 BIG IP Access Policy Manager 11.6.1 F5 BIG IP Access Policy Manager 11.6.2 F5 BIG IP Access Policy Manager 11.6.3 F5 BIG IP Access Policy Manager 11.6.3.1 F5 BIG IP Access Policy Manager 11.6.3.2 F5 BIG IP Access Policy Manager 11.6.3.3 F5 BIG IP Access Policy Manager 11.6.3.4 F5 BIG IP Access Policy Manager 11.6.4 F5 BIG IP Analytics 12.0.0 F5 BIG IP Analytics 11.5.2 F5 BIG IP Analytics 11.5.3 F5 BIG IP Analytics 11.5.4 F5 BIG IP Analytics 11.5.4.2 F5 BIG IP Analytics 11.5.4.2.74.291 F5 BIG IP Analytics 11.5.4.3 F5 BIG IP Analytics 11.5.4.4 F5 BIG IP Analytics 11.5.5 F5 BIG IP Analytics 11.5.6 F5 BIG IP Analytics 11.5.7 F5 BIG IP Analytics 11.5.8 F5 BIG IP Analytics 11.5.9 F5 BIG IP Analytics 11.5.10 F5 BIG IP Analytics 11.6.0 F5 BIG IP Analytics 11.6.1 F5 BIG IP Analytics 11.6.2 F5 BIG IP Analytics 11.6.3 F5 BIG IP Analytics 11.6.3.1 F5 BIG IP Analytics 11.6.3.2 F5 BIG IP Analytics 11.6.3.3 F5 BIG IP Analytics 11.6.3.4 F5 BIG IP Analytics 11.6.4 F5 BIG IP Advanced Firewall Manager 12.0.0 F5 BIG IP Advanced Firewall Manager 11.5.2 F5 BIG IP Advanced Firewall Manager 11.5.3 F5 BIG IP Advanced Firewall Manager 11.5.4 F5 BIG IP Advanced Firewall Manager 11.5.4.1 F5 BIG IP Advanced Firewall Manager 11.5.4.2 F5 BIG IP Advanced Firewall Manager 11.5.4.2.74.291 F5 BIG IP Advanced Firewall Manager 11.5.4.3 F5 BIG IP Advanced Firewall Manager 11.5.4.4 F5 BIG IP Advanced Firewall Manager 11.5.5 F5 BIG IP Advanced Firewall Manager 11.5.6 F5 BIG IP Advanced Firewall Manager 11.5.7 F5 BIG IP Advanced Firewall Manager 11.5.8 F5 BIG IP Advanced Firewall Manager 11.5.9 F5 BIG IP Advanced Firewall Manager 11.5.10 F5 BIG IP Advanced Firewall Manager 11.6.0 F5 BIG IP Advanced Firewall Manager 11.6.1 F5 BIG IP Advanced Firewall Manager 11.6.2 F5 BIG IP Advanced Firewall Manager 11.6.3 F5 BIG IP Advanced Firewall Manager 11.6.3.1 F5 BIG IP Advanced Firewall Manager 11.6.3.2 F5 BIG IP Advanced Firewall Manager 11.6.3.3 F5 BIG IP Advanced Firewall Manager 11.6.3.4 F5 BIG IP Advanced Firewall Manager 11.6.4 F5 BIG IP Domain Name System 12.0.0 F5 BIG IP Domain Name System 11.5.2 F5 BIG IP Domain Name System 11.5.3 F5 BIG IP Domain Name System 11.5.4 F5 BIG IP Domain Name System 11.5.4.2.74.291 F5 BIG IP Domain Name System 11.5.4.4 F5 BIG IP Domain Name System 11.5.5 F5 BIG IP Domain Name System 11.5.6 F5 BIG IP Domain Name System 11.5.7 F5 BIG IP Domain Name System 11.5.8 F5 BIG IP Domain Name System 11.5.9 F5 BIG IP Domain Name System 11.5.10 F5 BIG IP Domain Name System 11.6.0 F5 BIG IP Domain Name System 11.6.1 F5 BIG IP Domain Name System 11.6.2 F5 BIG IP Domain Name System 11.6.3 F5 BIG IP Domain Name System 11.6.3.1 F5 BIG IP Domain Name System 11.6.3.2 F5 BIG IP Domain Name System 11.6.3.3 F5 BIG IP Domain Name System 11.6.3.4 F5 BIG IP Domain Name System 11.6.4 F5 BIG IP Application Security Manager 12.0.0 F5 BIG IP Application Security Manager 11.5.2 F5 BIG IP Application Security Manager 11.5.3 F5 BIG IP Application Security Manager 11.5.4 F5 BIG IP Application Security Manager 11.5.4.1 F5 BIG IP Application Security Manager 11.5.4.2 F5 BIG IP Application Security Manager 11.5.4.2.74.291 F5 BIG IP Application Security Manager 11.5.4.3 F5 BIG IP Application Security Manager 11.5.4.4 F5 BIG IP Application Security Manager 11.5.5 F5 BIG IP Application Security Manager 11.5.6 F5 BIG IP Application Security Manager 11.5.7 F5 BIG IP Application Security Manager 11.5.8 F5 BIG IP Application Security Manager 11.5.9 F5 BIG IP Application Security Manager 11.5.10 F5 BIG IP Application Security Manager 11.6.0 F5 BIG IP Application Security Manager 11.6.1 F5 BIG IP Application Security Manager 11.6.2 F5 BIG IP Application Security Manager 11.6.3 F5 BIG IP Application Security Manager 11.6.3.1 F5 BIG IP Application Security Manager 11.6.3.2 F5 BIG IP Application Security Manager 11.6.3.3 F5 BIG IP Application Security Manager 11.6.3.4 F5 BIG IP Application Security Manager 11.6.4 F5 BIG IP Link Controller 12.0.0 F5 BIG IP Link Controller 11.5.2 F5 BIG IP Link Controller 11.5.3 F5 BIG IP Link Controller 11.5.4 F5 BIG IP Link Controller 11.5.4.1 F5 BIG IP Link Controller 11.5.4.2 F5 BIG IP Link Controller 11.5.4.2.74.291 F5 BIG IP Link Controller 11.5.4.3 F5 BIG IP Link Controller 11.5.4.4 F5 BIG IP Link Controller 11.5.5 F5 BIG IP Link Controller 11.5.6 F5 BIG IP Link Controller 11.5.7 F5 BIG IP Link Controller 11.5.8 F5 BIG IP Link Controller 11.5.9 F5 BIG IP Link Controller 11.5.10 F5 BIG IP Link Controller 11.6.0 F5 BIG IP Link Controller 11.6.1 F5 BIG IP Link Controller 11.6.2 F5 BIG IP Link Controller 11.6.3 F5 BIG IP Link Controller 11.6.3.1 F5 BIG IP Link Controller 11.6.3.2 F5 BIG IP Link Controller 11.6.3.3 F5 BIG IP Link Controller 11.6.3.4 F5 BIG IP Link Controller 11.6.4 F5 Enterprise Manager 3.1.1 F5 BIG IP Global Traffic Manager 12.0.0 F5 BIG IP Global Traffic Manager 11.5.2 F5 BIG IP Global Traffic Manager 11.5.3 F5 BIG IP Global Traffic Manager 11.5.4 F5 BIG IP Global Traffic Manager 11.5.4.1 F5 BIG IP Global Traffic Manager 11.5.4.2 F5 BIG IP Global Traffic Manager 11.5.4.2.74.291 F5 BIG IP Global Traffic Manager 11.5.4.3 F5 BIG IP Global Traffic Manager 11.5.4.4 F5 BIG IP Global Traffic Manager 11.5.5 F5 BIG IP Global Traffic Manager 11.5.6 F5 BIG IP Global Traffic Manager 11.5.7 F5 BIG IP Global Traffic Manager 11.5.8 F5 BIG IP Global Traffic Manager 11.5.9 F5 BIG IP Global Traffic Manager 11.5.10 F5 BIG IP Global Traffic Manager 11.6.0 F5 BIG IP Global Traffic Manager 11.6.1 F5 BIG IP Global Traffic Manager 11.6.2 F5 BIG IP Global Traffic Manager 11.6.3 F5 BIG IP Global Traffic Manager 11.6.3.1 F5 BIG IP Global Traffic Manager 11.6.3.2 F5 BIG IP Global Traffic Manager 11.6.3.3 F5 BIG IP Global Traffic Manager 11.6.3.4 F5 BIG IP Global Traffic Manager 11.6.4 F5 BIG IP Edge Gateway 12.0.0 F5 BIG IP Edge Gateway 11.5.2 F5 BIG IP Edge Gateway 11.5.3 F5 BIG IP Edge Gateway 11.5.4 F5 BIG IP Edge Gateway 11.5.4.2.74.291 F5 BIG IP Edge Gateway 11.5.4.4 F5 BIG IP Edge Gateway 11.5.5 F5 BIG IP Edge Gateway 11.5.6 F5 BIG IP Edge Gateway 11.5.7 F5 BIG IP Edge Gateway 11.5.8 F5 BIG IP Edge Gateway 11.5.9 F5 BIG IP Edge Gateway 11.5.10 F5 BIG IP Edge Gateway 11.6.0 F5 BIG IP Edge Gateway 11.6.1 F5 BIG IP Edge Gateway 11.6.2 F5 BIG IP Edge Gateway 11.6.3 F5 BIG IP Edge Gateway 11.6.3.1 F5 BIG IP Edge Gateway 11.6.3.2 F5 BIG IP Edge Gateway 11.6.3.3 F5 BIG IP Edge Gateway 11.6.3.4 F5 BIG IP Edge Gateway 11.6.4 F5 BIG IP Webaccelerator 12.0.0 F5 BIG IP Webaccelerator 11.5.2 F5 BIG IP Webaccelerator 11.5.3 F5 BIG IP Webaccelerator 11.5.4 F5 BIG IP Webaccelerator 11.5.4.2.74.291 F5 BIG IP Webaccelerator 11.5.4.4 F5 BIG IP Webaccelerator 11.5.5 F5 BIG IP Webaccelerator 11.5.6 F5 BIG IP Webaccelerator 11.5.7 F5 BIG IP Webaccelerator 11.5.8 F5 BIG IP Webaccelerator 11.5.9 F5 BIG IP Webaccelerator 11.5.10 F5 BIG IP Webaccelerator 11.6.0 F5 BIG IP Webaccelerator 11.6.1 F5 BIG IP Webaccelerator 11.6.2 F5 BIG IP Webaccelerator 11.6.3 F5 BIG IP Webaccelerator 11.6.3.1 F5 BIG IP Webaccelerator 11.6.3.2 F5 BIG IP Webaccelerator 11.6.3.3 F5 BIG IP Webaccelerator 11.6.3.4 F5 BIG IP Webaccelerator 11.6.4 F5 BIG IP Fraud Protection Service 11.5.2 F5 BIG IP Fraud Protection Service 11.5.3 F5 BIG IP Fraud Protection Service 11.5.4 F5 BIG IP Fraud Protection Service 11.5.4.2.74.291 F5 BIG IP Fraud Protection Service 11.5.5 F5 BIG IP Fraud Protection Service 11.5.6 F5 BIG IP Fraud Protection Service 11.5.7 F5 BIG IP Fraud Protection Service 11.5.8 F5 BIG IP Fraud Protection Service 11.5.9 F5 BIG IP Fraud Protection Service 11.5.10 F5 BIG IP Fraud Protection Service 11.6.0 F5 BIG IP Fraud Protection Service 11.6.1 F5 BIG IP Fraud Protection Service 11.6.2 F5 BIG IP Fraud Protection Service 11.6.3 F5 BIG IP Fraud Protection Service 11.6.3.1 F5 BIG IP Fraud Protection Service 11.6.3.2 F5 BIG IP Fraud Protection Service 11.6.3.3 F5 BIG IP Fraud Protection Service 11.6.3.4 F5 BIG IP Fraud Protection Service 11.6.4 F5 BIG IP Fraud Protection Service 12.0.0	348

Nessus

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL53990093.NASL
description	REST users with guest privileges may beable to escalate their privilegesand run commands with admin privileges. (CVE-2019-6646) Impact Users with guest privileges are able to exploit this vulnerability to escalate their access privileges.
last seen	2020-06-01
modified	2020-06-02
plugin id	127499
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127499
title	F5 Networks BIG-IP : iControl REST vulnerability (K53990093)

References

https://support.f5.com/csp/article/K53990093