CVE-2019-6662: Medium severity f5 access policy manager vulnerability

Q: What is CVE-2019-6662?

CVE-2019-6662 is a vulnerability on F5 BIG-IP products that allows sensitive information to be logged into local and remote log files.

Q: What software is affected by CVE-2019-6662?

CVE-2019-6662 affects F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, Domain Name System, Edge Gateway, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager, and Webaccelerator.

Q: How severe is CVE-2019-6662?

CVE-2019-6662 has a severity level of 6.5 (Medium).

Q: How can sensitive information be exposed in CVE-2019-6662?

Sensitive information can be exposed in CVE-2019-6662 when restjavad processes an invalid request.

Q: Is there a fix for CVE-2019-6662?

Yes, F5 has released a fix for CVE-2019-6662. Please refer to the F5 support article for more information.

Published Nov 15, 2019

Updated

On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data.

Affected Software

13 affected components

F5 BIG-IP Access Policy Manager>=13.1.0<13.1.1.5

F5 BIG-IP Advanced Firewall Manager>=13.1.0<13.1.1.5

F5 BIG-IP Analytics>=13.1.0<13.1.1.5

F5 Big-ip Application Acceleration Manager>=13.1.0<13.1.1.5

F5 BIG-IP Application Security Manager>=13.1.0<13.1.1.5

F5 Big-ip Domain Name System>=13.1.0<13.1.1.5

F5 BIG-IP Edge Gateway>=13.1.0<13.1.1.5

F5 Big-ip Fraud Protection Service>=13.1.0<13.1.1.5

F5 Big-ip Global Traffic Manager>=13.1.0<13.1.1.5

F5 Big-ip Link Controller>=13.1.0<13.1.1.5

F5 Big-ip Local Traffic Manager>=13.1.0<13.1.1.5

F5 Big-ip Policy Enforcement Manager>=13.1.0<13.1.1.5

F5 Big-ip Webaccelerator>=13.1.0<13.1.1.5

Event History

Nov 15, 2019

CVE Published

via MITRE·08:45 PM

Data Sourced

via MITRE·08:45 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-6662?

CVE-2019-6662 is a vulnerability on F5 BIG-IP products that allows sensitive information to be logged into local and remote log files.

What software is affected by CVE-2019-6662?

CVE-2019-6662 affects F5 BIG-IP Access Policy Manager, Advanced Firewall Manager, Analytics, Application Acceleration Manager, Application Security Manager, Domain Name System, Edge Gateway, Fraud Protection Service, Global Traffic Manager, Link Controller, Local Traffic Manager, Policy Enforcement Manager, and Webaccelerator.

How severe is CVE-2019-6662?