SB2019112601 - Improper Authentication in BIG-IP Engineering Hotfixes

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Authentication (CVE-ID: CVE-2019-6675)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in BIG-IP administrative authentication feature. A remote attacker can use LDAP, Active Directory, or Client Certificate LDAP to bypass authentication process and cause a complete compromise of the BIG-IP system.

Note: This vulnerability affects only the BIG-IP Engineering Hotfixes and does not affect any of the BIG-IP major, minor, or maintenance releases.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://api-u.f5.com/support/kb-articles/K55655944?cacheFlag=false
• https://support.f5.com/csp/article/K55655944?utm_source=f5support&utm_medium=RSS