CVE-2019-6646: High severity f5 access policy manager vulnerability

Q: What is CVE-2019-6646?

CVE-2019-6646 is a vulnerability that allows REST users with guest privileges on F5 BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1 to escalate their privileges and run commands with admin privileges.

Q: How does CVE-2019-6646 affect F5 BIG-IP?

CVE-2019-6646 affects F5 BIG-IP versions 11.5.2 to 11.6.4 and Enterprise Manager 3.1.1, allowing REST users with guest privileges to escalate their privileges and run commands with admin privileges.

Q: What is the severity of CVE-2019-6646?

The severity of CVE-2019-6646 is rated as high with a CVSS score of 8.8.

Q: How can I fix CVE-2019-6646?

To fix CVE-2019-6646, it is recommended to upgrade to a non-vulnerable version of F5 BIG-IP and Enterprise Manager.

Q: Where can I find more information about CVE-2019-6646?

More information about CVE-2019-6646 can be found at the following link: [https://support.f5.com/csp/article/K53990093](https://support.f5.com/csp/article/K53990093)

Published Sep 4, 2019

Updated

On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges.

Affected Software

27 affected components

F5 BIG-IP Access Policy Manager>=11.5.2<=11.6.4

F5 BIG-IP Access Policy Manager=12.0.0

F5 BIG-IP Advanced Firewall Manager>=11.5.2<=11.6.4

F5 BIG-IP Advanced Firewall Manager=12.0.0

F5 BIG-IP Analytics>=11.5.2<=11.6.4

F5 BIG-IP Analytics=12.0.0

F5 Big-ip Application Acceleration Manager>=11.5.2<=11.6.4

F5 Big-ip Application Acceleration Manager=12.0.0

F5 BIG-IP Application Security Manager>=11.5.2<=11.6.4

F5 BIG-IP Application Security Manager=12.0.0

F5 Big-ip Domain Name System>=11.5.2<=11.6.4

F5 Big-ip Domain Name System=12.0.0

F5 BIG-IP Edge Gateway>=11.5.2<=11.6.4

F5 BIG-IP Edge Gateway=12.0.0

F5 Big-ip Fraud Protection Service>=11.5.2<=11.6.4

F5 Big-ip Fraud Protection Service=12.0.0

F5 Big-ip Global Traffic Manager>=11.5.2<=11.6.4

F5 Big-ip Global Traffic Manager=12.0.0

F5 Big-ip Link Controller>=11.5.2<=11.6.4

F5 Big-ip Link Controller=12.0.0

F5 Big-ip Local Traffic Manager>=11.5.2<=11.6.4

F5 Big-ip Local Traffic Manager=12.0.0

F5 Big-ip Policy Enforcement Manager>=11.5.2<=11.6.4

F5 Big-ip Policy Enforcement Manager=12.0.0

F5 Big-ip Webaccelerator>=11.5.2<=11.6.4

F5 Big-ip Webaccelerator=12.0.0

F5 Enterprise Manager=3.1.1

Event History

Sep 4, 2019

CVE Published

via MITRE·05:13 PM

Data Sourced

via MITRE·05:13 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-6646?

CVE-2019-6646 is a vulnerability that allows REST users with guest privileges on F5 BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1 to escalate their privileges and run commands with admin privileges.

How does CVE-2019-6646 affect F5 BIG-IP?

CVE-2019-6646 affects F5 BIG-IP versions 11.5.2 to 11.6.4 and Enterprise Manager 3.1.1, allowing REST users with guest privileges to escalate their privileges and run commands with admin privileges.

What is the severity of CVE-2019-6646?

The severity of CVE-2019-6646 is rated as high with a CVSS score of 8.8.

How can I fix CVE-2019-6646?

To fix CVE-2019-6646, it is recommended to upgrade to a non-vulnerable version of F5 BIG-IP and Enterprise Manager.

Where can I find more information about CVE-2019-6646?