CVE-2019-6600 Cross-site scripting in BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)

Medium 6.1 Published 13 Mar 2019 Updated 16 Sep 2024

Unsanitized values in the login page allow cross-site scripting attacks against unauthenticated clients when remote authentication is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-6600?

CVE-2019-6600 is a medium-severity cross-site scripting vulnerability in F5 Big-Ip Access Policy Manager, published on 13 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.

Weakness: CWE-79

Which versions are affected by CVE-2019-6600?

It affects 13 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 7 more.

How do I fix CVE-2019-6600?

No fix has been published for CVE-2019-6600 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-6600 being exploited?

There is no known exploitation of CVE-2019-6600 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-q48m-537g-pxq7.