CVE-2016-3686: Infoleak
Published Apr 13, 2016
·Updated
The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote attackers to obtain sensitive SessionId information by leveraging access to the Location HTTP header in a redirect.
Affected Software
18 affected components
F5 BIG-IP Edge Gateway=11.0.0
F5 BIG-IP Edge Gateway=11.1.0
F5 BIG-IP Edge Gateway=11.2.0
F5 BIG-IP Edge Gateway=11.2.1
F5 BIG-IP Edge Gateway=11.3.0
F5 BIG-IP Access Policy Manager=11.0.0
F5 BIG-IP Access Policy Manager=11.1.0
F5 BIG-IP Access Policy Manager=11.2.0
F5 BIG-IP Access Policy Manager=11.2.1
F5 BIG-IP Access Policy Manager=11.3.0
F5 BIG-IP Access Policy Manager=11.4.0
F5 BIG-IP Access Policy Manager=11.4.1
F5 BIG-IP Access Policy Manager=11.5.0
F5 BIG-IP Access Policy Manager=11.5.1
F5 BIG-IP Access Policy Manager=11.5.2
F5 BIG-IP Access Policy Manager=11.5.3
F5 BIG-IP Access Policy Manager=11.5.4
F5 BIG-IP Access Policy Manager=11.6.0
Event History
Apr 13, 2016
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3686?
CVE-2016-3686 has a medium severity rating due to potential exposure of sensitive SessionId information.
2
How do I fix CVE-2016-3686?
To fix CVE-2016-3686, upgrade your F5 BIG-IP APM to version 11.6.0 HF6 or later.
3
Which versions of F5 BIG-IP are affected by CVE-2016-3686?
CVE-2016-3686 affects F5 BIG-IP APM versions prior to 11.6.0 HF6 and BIG-IP Edge Gateway versions 11.0.0 to 11.3.0.
4
What types of attacks are possible due to CVE-2016-3686?
Exploitation of CVE-2016-3686 allows remote attackers to capture sensitive SessionId information through manipulated Location HTTP headers.
5
When was CVE-2016-3686 disclosed?
CVE-2016-3686 was publicly disclosed in 2016.