In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/107470 | Broken Link Third Party Advisory VDB Entry |
https://support.f5.com/csp/article/K23734425 | Vendor Advisory |
http://www.securityfocus.com/bid/107470 | Broken Link Third Party Advisory VDB Entry |
https://support.f5.com/csp/article/K23734425 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
Configuration 9 (hide)
|
Configuration 10 (hide)
|
Configuration 11 (hide)
|
Configuration 12 (hide)
|
Configuration 13 (hide)
|
History
21 Nov 2024, 04:46
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.securityfocus.com/bid/107470 - Broken Link, Third Party Advisory, VDB Entry | |
References | () https://support.f5.com/csp/article/K23734425 - Vendor Advisory |
Information
Published : 2019-03-13 22:29
Updated : 2024-11-21 04:46
NVD link : CVE-2019-6600
Mitre link : CVE-2019-6600
CVE.ORG link : CVE-2019-6600
JSON object : View
Products Affected
f5
- big-ip_application_security_manager
- big-ip_application_acceleration_manager
- big-ip_global_traffic_manager
- big-ip_policy_enforcement_manager
- big-ip_edge_gateway
- big-ip_domain_name_system
- big-ip_fraud_protection_service
- big-ip_link_controller
- big-ip_local_traffic_manager
- big-ip_webaccelerator
- big-ip_advanced_firewall_manager
- big-ip_access_policy_manager
- big-ip_analytics
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')