sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2019-6642 Privilege escalation in BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager

High 8.8 Published Updated

Authenticated users with file upload capabilities can escalate privileges to root shell access via the TMOS Shell interface in F5 BIG-IP products.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2019-6642?

CVE-2019-6642 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager, published on 1 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

Which versions are affected by CVE-2019-6642?

It affects 16 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 10 more.

How do I fix CVE-2019-6642?

No fix has been published for CVE-2019-6642 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-6642 being exploited?

There is no known exploitation of CVE-2019-6642 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-g33f-4mqv-pqxc.

Is CVE-2019-6642 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free