F5 BIG-IP (ASM)
En bref
- Source
- NVD
- EPSS
- EPSS 1.43 % · centile 73 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- f5
- Statut NVD
- Modified
Description
On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on arbitrary processes. The attack requires an authenticated user with role of "Guest" or greater privilege. Note: "No Access" cannot login so technically it's a role but a user with this access role cannot perform the attack.
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-16196
- GCVE · GCVE-0-2019-6637
Configurations affectées (CPE NVD)
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*≥ 12.1.0 < 12.1.4.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*≥ 13.0.0 < 13.1.1.5cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*≥ 14.0.0 < 14.0.0.5cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*≥ 14.1.0 < 14.1.0.6
Produits affectés
| Produit | Versions |
|---|---|
| F5 · BIG-IP (ASM) | affected BIG-IP (ASM) 14.1.0-14.1.0.5 ; affected 14.0.0-14.0.0.4 ; affected 13.0.0-13.1.1.4 ; affected 12.1.0-12.1.4 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |