1. Home
  2. CVE Database
  3. CVE-2019-6685
HIGH · 7.8

CVE-2019-6685

On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an...

Vulnerability Description

On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an elevation of privilege, configuration modification, and arbitrary system command execution.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
F5Big-Ip Access Policy Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Advanced Firewall Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Analytics>= 11.5.2, <= 11.6.5
F5Big-Ip Application Acceleration Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Application Security Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Domain Name System>= 11.5.2, <= 11.6.5
F5Big-Ip Edge Gateway>= 11.5.2, <= 11.6.5
F5Big-Ip Fraud Protection Service>= 11.5.2, <= 11.6.5
F5Big-Ip Global Traffic Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Link Controller>= 11.5.2, <= 11.6.5
F5Big-Ip Local Traffic Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Policy Enforcement Manager>= 11.5.2, <= 11.6.5
F5Big-Ip Webaccelerator>= 11.5.2, <= 11.6.5

Related Weaknesses (CWE)

CWE-269

References

FAQ

What is CVE-2019-6685?

CVE-2019-6685 is a vulnerability with a CVSS score of 7.8 (HIGH). On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an...

How severe is CVE-2019-6685?

CVE-2019-6685 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-6685?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager.