NetSight
IP …
medium5.5

CVE-2019-19151

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iW…

Impact

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to access objects on the file system which would not normally be allowed.

Affected products

VendorProductAffected versions
F5Big-Iq Centralized Management
from 5.0.0 through 5.4.0
from 6.0.0 through 6.1.0
Version 7.0.0
F5Big-Ip Access Policy Manager
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Advanced Firewall Manager
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Analytics
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Application Acceleration Manager
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Application Security Manager
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Domain Name System
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Edge Gateway
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Fraud Protection Service
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Global Traffic Manager
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Link Controller
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0
F5Big-Ip Local Traffic Manager
from 11.5.1 through 11.6.5
from 12.1.0 through 12.1.5
from 13.0.0 through 13.1.3
from 14.0.0 through 14.1.2
from 15.0.0 through 15.1.0

Weakness classification

CWE-269

References