Skip to content
OpenAdvisories
Unscored CVE-2019-6642 EUVD-2019-16201GHSA-g33f-4mqv-pqxc

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0…

Published Jul 1, 2019 · Updated Aug 4, 2024 · Assigned by f5

Vendor: F5 Product: BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager Category: Network devices

Description

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

Affected products

VendorProductAffectedFixed
F5 BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0, 5.1.0-5.4.0, iWorkflow 2.3.0, Enterprise Manager 3.1.1 —

References