9.4

CVE-2019-6644

Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1.0-12.1.4 BIG-IP will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Big-ip Local Traffic Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Local Traffic Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Local Traffic Manager Version 14.0.0
F5 ≫ Big-ip Local Traffic Manager Version 14.1.0
F5 ≫ Big-ip Advanced Firewall Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Advanced Firewall Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Application Acceleration Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Application Acceleration Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Analytics Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Analytics Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Analytics Version 14.0.0
F5 ≫ Big-ip Analytics Version 14.1.0
F5 ≫ Big-ip Access Policy Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Access Policy Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Access Policy Manager Version 14.0.0
F5 ≫ Big-ip Access Policy Manager Version 14.1.0
F5 ≫ Big-ip Application Security Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Application Security Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Edge Gateway Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Edge Gateway Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Edge Gateway Version 14.0.0
F5 ≫ Big-ip Edge Gateway Version 14.1.0
F5 ≫ Big-ip Fraud Protection Service Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Fraud Protection Service Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Fraud Protection Service Version 14.0.0
F5 ≫ Big-ip Fraud Protection Service Version 14.1.0
F5 ≫ Big-ip Global Traffic Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Global Traffic Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Global Traffic Manager Version 14.0.0
F5 ≫ Big-ip Global Traffic Manager Version 14.1.0
F5 ≫ Big-ip Link Controller Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Link Controller Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Link Controller Version 14.0.0
F5 ≫ Big-ip Link Controller Version 14.1.0
F5 ≫ Big-ip Policy Enforcement Manager Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Policy Enforcement Manager Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Webaccelerator Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Webaccelerator Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Webaccelerator Version 14.0.0
F5 ≫ Big-ip Webaccelerator Version 14.1.0
F5 ≫ Big-ip Domain Name System Version >= 12.1.3 <= 12.1.4
F5 ≫ Big-ip Domain Name System Version >= 13.0.0 <= 13.1.2
F5 ≫ Big-ip Domain Name System Version 14.0.0
F5 ≫ Big-ip Domain Name System Version 14.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.4% 0.69
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.4 3.9 5.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://support.f5.com/csp/article/K75532331
Vendor Advisory