PT-2016-5659 · F5 · F5 Edge Gateway+1

Publicado 2016-06-16 · Atualizado 2016-06-20 · CVE-2016-3687

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 F5 Edge Gateway version 11.2.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a base64-encoded URL in the SSO ORIG URI parameter when using multi-domain single sign-on (SSO).

Recommendations For F5 BIG-IP APM versions 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6, update to version 11.6.0 HF6 or later. For F5 Edge Gateway version 11.2.1, consider disabling the multi-domain single sign-on (SSO) feature until a patch is available. As a temporary workaround, restrict access to the SSO ORIG URI parameter to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2016-3687

Produtos afetados

F5 Big-Ip Apm

F5 Edge Gateway

Referências · 4

• https://osv.dev/vulnerability/CVE-2016-3687 · Aviso do Fabricante
• https://support.f5.com/kb/en-us/solutions/public/k/26/sol26738102.html · Aviso do Fabricante
• http://securitytracker.com/id/1036111 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-3687 · Nota de Segurança