CVE-2019-6636

On BIG-IP (AFM, ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, 12.1.0-12.1.4, and 11.5.1-11.6.4, a stored cross-site scripting vulnerability in AFM feed list. In the worst case, an attacker can store a CSRF which results in code execution as the admin user. The level of user role which can perform this attack are resource administrator and administrator.

Score

CVSS 3.0 8.4 High

Status

Modified - f5sirt@f5.com

Published

2019-07-03

Last modified

2024-08-04

Weaknesses

CWE-352, CWE-79

Affected products

• Asm (F5)
• Big-ip Advanced Firewall Manager (F5)
• Big-ip Afm (F5)
• Big-ip Application Security Manager (F5)

References

• http://www.securityfocus.com/bid/109108
• https://support.f5.com/csp/article/K68151373