medium6.1
CVE-2018-5548
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an acc…
Impact
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | from 11.6.1 through 11.6.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://sbudella.altervista.org/blog/20180911-cve-2018-5548.html
- http://www.securityfocus.com/bid/105353
- https://support.f5.com/csp/article/K66171422
- http://sbudella.altervista.org/blog/20180911-cve-2018-5548.html
- http://www.securityfocus.com/bid/105353
- https://support.f5.com/csp/article/K66171422