9

CVE-2019-6642

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Access Policy Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Access Policy Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Access Policy Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Access Policy Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Access Policy Manager Version 15.0.0
F5 ≫ Big-ip Advanced Firewall Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Advanced Firewall Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Application Acceleration Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Link Controller Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Link Controller Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Link Controller Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Link Controller Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Link Controller Version 15.0.0
F5 ≫ Big-ip Policy Enforcement Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Policy Enforcement Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Webaccelerator Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Webaccelerator Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Webaccelerator Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Webaccelerator Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Webaccelerator Version 15.0.0
F5 ≫ Big-ip Application Security Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Application Security Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Application Security Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Application Security Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Local Traffic Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Local Traffic Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Local Traffic Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Local Traffic Manager Version 15.0.0
F5 ≫ Big-ip Fraud Protection Service Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Fraud Protection Service Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Fraud Protection Service Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Fraud Protection Service Version 15.0.0
F5 ≫ Big-ip Global Traffic Manager Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Global Traffic Manager Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Global Traffic Manager Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Global Traffic Manager Version 15.0.0
F5 ≫ Big-ip Analytics Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Analytics Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Analytics Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Analytics Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Analytics Version 15.0.0
F5 ≫ Big-ip Edge Gateway Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Edge Gateway Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Edge Gateway Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Edge Gateway Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Edge Gateway Version 15.0.0
F5 ≫ Big-ip Domain Name System Version >= 11.5.2 <= 11.6.4
F5 ≫ Big-ip Domain Name System Version >= 12.1.0 <= 12.1.4.2
F5 ≫ Big-ip Domain Name System Version >= 13.0.0 <= 13.1.1.5
F5 ≫ Big-ip Domain Name System Version >= 14.0.0 <= 14.1.0.5
F5 ≫ Big-ip Domain Name System Version 15.0.0
F5 ≫ Big-iq Centralized Management Version >= 5.1.0 <= 5.4.0
F5 ≫ Big-iq Centralized Management Version >= 6.0.0 <= 6.1.0
F5 ≫ Enterprise Manager Version 3.1.1
F5 ≫ Iworkflow Version 2.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.82% 0.759
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://support.f5.com/csp/article/K40378764
Vendor Advisory
https://support.f5.com/csp/article/K40378764?utm_source=f5support&amp%3Butm_medium=RSS