Security readout for executives and security teams
Plain-English summary
Affected F5 BIG-IP APM versions can write a client session identifier into logs when debug logging is enabled for a virtual server using a per-session policy. This is mainly an information exposure risk: the business concern is who can read those logs and whether session identifiers were retained or exported.
Executive priority
Treat as a targeted cleanup and configuration review, not an emergency based on current evidence. Prioritize environments where debug logs were enabled or widely accessible.
Technical view
CVE-2019-19150 affects F5 BIG-IP APM versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1. The condition requires a per-session policy attached to the virtual server and debug logging enabled.
Likely exposure
Exposure is most likely in organizations running the listed BIG-IP APM versions with debug logging enabled in production or sending APM logs to shared SIEM, support, or admin repositories.
Exploitation context
The supplied sources do not show active exploitation, KEV listing, CVSS scoring, or public exploit details. Risk depends on whether exposed session identifiers are usable and whether unauthorized users can access retained logs.
Researcher notes
Key missing evidence includes CVSS, CWE classification, exact fix versions, and whether logged client-session-id values enable session misuse. Analysis should stay tied to F5 K37890841 and local configuration evidence.
Mitigation direction
- Review F5 advisory K37890841 for vendor-confirmed fixes or branch-specific guidance.
- Disable debug logging on affected APM virtual servers unless operationally required.
- Limit access to BIG-IP APM logs and downstream SIEM copies.
- Rotate or purge exposed logs according to incident-response and retention requirements.
- Plan upgrades or hotfixes only against F5-supported guidance.
Validation and detection
- Inventory BIG-IP APM versions against the affected ranges listed in the CVE.
- Identify virtual servers with attached per-session policies.
- Confirm whether debug logging is or was enabled for those virtual servers.
- Review APM log stores for client-session-id entries during affected periods.
- Verify log access controls, retention, and forwarding destinations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19150 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.f5.com/csp/article/K37890841CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.