Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-6618

On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the files

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
f5

Description

On BIG-IP 14.0.0-14.1.0.1, 13.0.0-13.1.1.4, 12.1.0-12.1.4, 11.6.1-11.6.3.4, and 11.5.2-11.5.8, users with the Resource Administrator role can modify sensitive portions of the filesystem if provided Advanced Shell Access, such as editing /etc/passwd. This allows modifications to user objects and is contrary to our definition for the Resource Administrator (RA) role restrictions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

F5 BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)

  • 14.0.0-14.1.0.1affected
  • 13.0.0-13.1.1.4affected
  • 12.1.0-12.1.4affected
  • 11.6.1-11.6.3.4affected
  • 11.5.2-11.5.8affected

References