K37890841 : BIG-IP APM logging disclosure vulnerability CVE-2019-19150

2019-12-2000:00:00

my.f5.com

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.4%

JSON

Security Advisory Description

The BIG-IP APM system logs the client-session-id when a per-session policy is attached to the virtual server with debug logging enabled. (CVE-2019-19150)

Impact

The BIG-IP APM system logs the client-session-id in the log files and is available to authenticated administrators of the system.

CPENameOperatorVersion
big-iq centralized managementeq5.2.0
big-iq centralized managementeq5.3.0
big-iq centralized managementeq5.4.0
big-iq centralized managementeq6.0.0
big-iq centralized managementeq6.0.1
big-iq centralized managementeq6.1.0
big-iq centralized managementeq7.0.0
big-ip afmeq11.5.10
big-ip afmeq11.5.2
big-ip afmeq11.5.3

Name	Operator	Version
big-iq centralized management	eq	5.2.0
big-iq centralized management	eq	5.3.0
big-iq centralized management	eq	5.4.0
big-iq centralized management	eq	6.0.0
big-iq centralized management	eq	6.0.1
big-iq centralized management	eq	6.1.0
big-iq centralized management	eq	7.0.0
big-ip afm	eq	11.5.10
big-ip afm	eq	11.5.2
big-ip afm	eq	11.5.3

Rows per page:

1-10 of 2901