Lucene search

[email protected]CVE-2016-7467

HistoryApr 11, 2017 - 2:59 p.m.

CVE-2016-7467

2017-04-1114:59:00

CWE-20

[email protected]

web.nvd.nist.gov

big-ip

apm

cve-2016-7467

saml

authentication

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

5.3 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

52.1%

JSON

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector.

CPENameOperatorVersion
f5:big-ip_access_policy_managerf5 big-ip access policy managereq12.0.0
f5:big-ip_access_policy_managerf5 big-ip access policy managereq12.1.1
f5:big-ip_access_policy_managerf5 big-ip access policy managereq12.1.0
f5:big-ip_access_policy_managerf5 big-ip access policy managereq11.5.4
f5:big-ip_access_policy_managerf5 big-ip access policy managereq11.6.1
f5:big-ip_access_policy_managerf5 big-ip access policy managereq11.6.0

CPE	Name	Operator	Version
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	12.0.0
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	12.1.1
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	12.1.0
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	11.5.4
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	11.6.1
f5:big-ip_access_policy_manager	f5 big-ip access policy manager	eq	11.6.0

References

www.securityfocus.com/bid/97168

www.securitytracker.com/id/1038131

support.f5.com/csp/article/K95444512

Social References

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

5.3 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

52.1%

JSON

Related for CVE-2016-7467

f51 prion1 nessus1 cvelist1 openvas1