CVE-2019-6637: f5 big-ip_application_security_manager
Vulnerability summary
CVE-2019-6637 is a medium (CVSS 6.5) vulnerability in f5 big-ip_application_security_manager. EPSS estimates a 1.46% chance of exploitation in the next 30 days, higher than 73.1% of scored vulnerabilities.
Timeline
- 03-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
On BIG-IP (ASM) 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.1.4, and 12.1.0-12.1.4, Application logic abuse of ASM REST endpoints can lead to instability of BIG-IP system. Exploitation of this issue causes excessive memory consumption which results in the Linux kernel triggering OOM killer on arbitrary processes. The attack requires an authenticated user with role of "Guest" or greater privilege. Note: "No Access" cannot login so technically it's a role but a user with this access role cannot perform the attack.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.46%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.46% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
F52 products
- big-ip_application_security_manager≥ 12.1.0, < 12.1.4.1 | ≥ 13.0.0, < 13.1.1.5 | ≥ 14.0.0, < 14.0.0.5 | ≥ 14.1.0, < 14.1.0.6
- big-ip_asmBIG-IP (ASM) 14.1.0-14.1.0.5 | 14.0.0-14.0.0.4 | 13.0.0-13.1.1.4 | 12.1.0-12.1.4
1 vendor · 2 products