CVE-2019-19150 : What You Need to Know

This CVE-2019-19150 article provides details about an information disclosure vulnerability affecting F5's BIG-IP APM system.

Understanding CVE-2019-19150

This CVE involves the logging of client-session-id on specific versions of BIG-IP APM when certain conditions are met.

What is CVE-2019-19150?

The BIG-IP APM system logs the client-session-id on versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 under specific circumstances.

The Impact of CVE-2019-19150

This vulnerability can lead to information disclosure due to the logging of sensitive client-session-id data.

Technical Details of CVE-2019-19150

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

The BIG-IP APM system logs the client-session-id when a per-session policy is attached to the virtual server with debug logging enabled.

Affected Systems and Versions

The following versions of BIG-IP APM are affected:

15.0.0-15.0.1.1
14.1.0-14.1.2
14.0.0-14.0.1
13.1.0-13.1.3.1
12.1.0-12.1.5
11.5.2-11.6.5.1

Exploitation Mechanism

The vulnerability occurs when debug logging is turned on and a per-session policy is attached to the virtual server.

Mitigation and Prevention

Protecting systems from CVE-2019-19150 is crucial for maintaining security.

Immediate Steps to Take

Disable debug logging unless necessary
Regularly monitor logs for any unauthorized access

Long-Term Security Practices

Implement least privilege access controls
Conduct regular security audits and assessments

Patching and Updates

Apply patches provided by F5 to address this vulnerability