1. Home
  2. CVE Database
  3. CVE-2019-6600
MEDIUM · 6.1

CVE-2019-6600

In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "g...

Vulnerability Description

In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
F5Big-Ip Local Traffic Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Application Acceleration Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Advanced Firewall Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Analytics>= 11.5.1, <= 11.5.8
F5Big-Ip Access Policy Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Application Security Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Domain Name System>= 11.5.1, <= 11.5.8
F5Big-Ip Edge Gateway>= 11.5.1, <= 11.5.8
F5Big-Ip Fraud Protection Service>= 11.5.1, <= 11.5.8
F5Big-Ip Global Traffic Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Link Controller>= 11.5.1, <= 11.5.8
F5Big-Ip Policy Enforcement Manager>= 11.5.1, <= 11.5.8
F5Big-Ip Webaccelerator>= 11.5.1, <= 11.5.8

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2019-6600?

CVE-2019-6600 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "g...

How severe is CVE-2019-6600?

CVE-2019-6600 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-6600?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Local Traffic Manager, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Access Policy Manager.