CVE-2019-19151

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-23 · updated 2026-06-17
Weakness: CWE-269

Description

On BIG-IP versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IQ versions 7.0.0, 6.0.0-6.1.0, and 5.0.0-5.4.0, iWorkflow version 2.3.0, and Enterprise Manager version 3.1.1, authenticated users granted TMOS Shell (tmsh) privileges are able access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to access objects on the file system which would not normally be allowed.

Affected products

F5 BIG-IP APM: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
BIG-IP: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Big-Ip Analytics: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Networks, Inc. BIG-IP (AAM): from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
BIG-IP ASM: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 BIG-IP DNS: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Big-Ip Edge Gateway: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Big-Ip Fraud Protection Service: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Big-Ip Global Traffic Manager: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Big-Ip Link Controller: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 BIG-IP (LTM): from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Networks, Inc. BIG-IP (PEM): from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 Big-Ip Webaccelerator: from 11.5.1 through 11.6.5; from 12.1.0 through 12.1.5; from 13.0.0 through 13.1.3; from 14.0.0 through 14.1.2; from 15.0.0 through 15.1.0
F5 BIG-IQ: from 5.0.0 through 5.4.0; from 6.0.0 through 6.1.0; 7.0.0
F5 Networks, Inc. Enterprise Manager: 3.1.1
F5 Networks, Inc. iWorkflow: 2.3.0

References

Get alerted when CVE-2019-19151 or the next vulnerability affects your stack