Code injection

2018-09-1314:29:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.6%

JSON

On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.

CPENameOperatorVersion
big-ip_access_policy_managerge11.6.1
big-ip_access_policy_managerle11.6.3

CPE	Name	Operator	Version
	big-ip_access_policy_manager	ge	11.6.1
	big-ip_access_policy_manager	le	11.6.3

References

sbudella.altervista.org/blog/20180911-cve-2018-5548.html

www.securityfocus.com/bid/105353

support.f5.com/csp/article/K66171422