sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2019-6663 Server-side request forgery in BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager

Medium 5.5 Published Updated

Attackers can bypass DNS pinning protections to access internal resources via the configuration utility.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Local or same network only
Victim action needed
A user has to click or open something
Fix
None listed

What is CVE-2019-6663?

CVE-2019-6663 is a medium-severity server-side request forgery vulnerability in F5 Big-Ip Access Policy Manager, published on 15 Nov 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack.

Weakness: CWE-20

Which versions are affected by CVE-2019-6663?

It affects 16 products.

Products include F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager, F5 Big-Ip Analytics, F5 Big-Ip Application Acceleration Manager, F5 Big-Ip Application Security Manager, F5 Big-Ip Domain Name System and 10 more.

How do I fix CVE-2019-6663?

No fix has been published for CVE-2019-6663 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2019-6663 being exploited?

There is no known exploitation of CVE-2019-6663 in the wild and no public exploit code.

All F5 Big-Ip Access Policy Manager vulnerabilities

Sources

Also known as GHSA-2x5q-fj99-48h5.

Is CVE-2019-6663 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free