« Volver al listado

CVE-2019-6641

Estado: ModificadaMedia (6.5)—

On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. The attack can only come from an authenticated user; all roles are capable of performing the attack. Unauthenticated users cannot perform this attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (13)

F5 — Big-ip Access Policy ManagerF5 — Big-ip Advanced Firewall ManagerF5 — Big-ip AnalyticsF5 — Big-ip Application Acceleration ManagerF5 — Big-ip Application Security ManagerF5 — Big-ip Domain Name SystemF5 — Big-ip Edge GatewayF5 — Big-ip Fraud Protection ServiceF5 — Big-ip Global Traffic ManagerF5 — Big-ip Link ControllerF5 — Big-ip Local Traffic ManagerF5 — Big-ip Policy Enforcement ManagerF5 — Big-ip Webaccelerator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-6641",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "f5sirt@f5.com",
      "affectedData": [
        {
          "vendor": "F5",
          "product": "BIG-IP",
          "versions": [
            {
              "status": "affected",
              "version": "BIG-IP 12.1.0-12.1.4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-03T19:15:13.487",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/109060",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://support.f5.com/csp/article/K22384173",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://support.f5.com/csp/article/K22384173?utm_source=f5support&amp%3Butm_medium=RSS",
      "source": "f5sirt@f5.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/109060",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.f5.com/csp/article/K22384173",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.f5.com/csp/article/K22384173?utm_source=f5support&amp%3Butm_medium=RSS",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On BIG-IP 12.1.0-12.1.4.1, undisclosed requests can cause iControl REST processes to crash. The attack can only come from an authenticated user; all roles are capable of performing the attack. Unauthenticated users cannot perform this attack."
    },
    {
      "lang": "es",
      "value": "En BIG-IP 12.1.0-12.1.4.1, las solicitudes no reveladas pueden hacer que los procesos REST de iControl se bloqueen. El ataque solo puede venir de un usuario identificado; Todos los roles son capaces de realizar el ataque. Los usuarios no identificados no pueden realizar este ataque."
    }
  ],
  "lastModified": "2026-06-17T02:39:25.187",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D838747-055B-4392-8CF1-36B05D372C48",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D0A3C92-5DA0-4D7F-B936-9484ED5FBC51",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03E44756-1682-4EB8-84F2-27C10B32CEDF",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3597D2DC-7F9B-4F1A-9EBB-F99308EF9994",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "986F4025-5D78-4930-8E47-0FA2FA902685",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EE35851-30B3-4E95-A431-07D04D9B5A73",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8041DDC2-0DE0-4A48-9862-487F9F1A2C7D",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99756A5B-DC9B-4FC7-9912-A2CCDA755370",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97102397-035B-40B0-A80F-D53FCCE4E92D",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "141E24AE-DA85-4807-9302-5526F2771B54",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F955A4D6-9FC3-4D60-8DF9-44A7F783D30F",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C09BAE4-5478-4A89-88D2-4CF28233C1A2",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            },
            {
              "criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87D93FF1-81D1-47BF-A7DF-C43194F48E8A",
              "versionEndIncluding": "12.1.4",
              "versionStartIncluding": "12.1.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com"
}