CVE-2019-6653 : Security Advisory and Response

A security flaw known as Stored Cross Site Scripting has been detected in a page within a BIG-IQ system version 6.0.0-6.1.0 or 5.2.0-5.4.0. This vulnerability allows users with Device Manager and Administrator privileges to store and launch attacks.

Understanding CVE-2019-6653

This CVE involves a Stored Cross Site Scripting vulnerability in specific versions of BIG-IQ systems.

What is CVE-2019-6653?

Stored Cross Site Scripting vulnerability in BIG-IQ systems version 6.0.0-6.1.0 or 5.2.0-5.4.0.

The Impact of CVE-2019-6653

Allows users with Device Manager and Administrator privileges to store and execute attacks.

Technical Details of CVE-2019-6653

This section provides technical details of the vulnerability.

Vulnerability Description

Stored Cross Site Scripting (XSS) vulnerability in BIG-IQ systems.

Affected Systems and Versions

Affected versions: 6.0.0-6.1.0, 5.2.0-5.4.0.

Exploitation Mechanism

Users with Device Manager and Administrator roles can exploit the vulnerability.

Mitigation and Prevention

Steps to address and prevent the CVE-2019-6653 vulnerability.

Immediate Steps to Take

Update BIG-IQ systems to non-vulnerable versions.
Restrict access to affected pages for non-privileged users.
Monitor and audit user activities for suspicious behavior.

Long-Term Security Practices

Regular security training for users on identifying and avoiding XSS attacks.
Implement secure coding practices to prevent XSS vulnerabilities.

Patching and Updates

Apply patches provided by the vendor to fix the vulnerability.