Security readout for executives and security teams
CVE-2019-6639 is a stored cross-site scripting issue in F5 BIG-IP AFM and PEM management pages. It affects the control plane only, not traffic processing. The attacker must already be a malicious resource administrator, so the main business risk is privileged insider or compromised admin-account abuse. Exposure is limited to organizations running affected BIG-IP AFM or PEM versions with access to the TMUI control plane. Internet-facing application traffic is not the attack path, but exposed management interfaces or weak admin governance increase risk. Treat this as a controlled but real management-plane risk. Prioritize remediation where BIG-IP management access is broad, externally reachable, or where privileged account controls are weak. Mitigation focus: Review F5 advisory K61002104 for vendor-approved fixes or mitigations.; Identify and upgrade or retire affected BIG-IP AFM/PEM versions per F5 guidance.; Restrict TMUI management access to trusted administrative networks only..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-6639 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.f5.com/csp/article/K61002104CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.