VULNERABILITY INTELLIGENCE

CVE-2019-6600

CVSS score6.1 MEDIUM

EPSS probability1.24%

CISA KEVNot currently listed

Published2019-03-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

f5sirt@f5.com — Broken Link, Third Party Advisory, VDB Entry
f5sirt@f5.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory