Description
On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an access profile, allowing a malicious user to build a redirect URI value using different blocks of cipher texts.
Metrics
CVSS 3.0 6.1/10
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| F5 Networks, Inc. | BIG-IP APM | 11.6.0-11.6.3 |
References
- http://sbudella.altervista.org/blog/20180911-cve-2018-5548.htmlExploit, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/105353Third Party Advisory, VDB Entry
- https://support.f5.com/csp/article/K66171422Vendor Advisory
- http://sbudella.altervista.org/blog/20180911-cve-2018-5548.htmlExploit, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/105353Third Party Advisory, VDB Entry
- https://support.f5.com/csp/article/K66171422Vendor Advisory
Timeline
- Published
- Sep 13, 2018
- Last modified
- Jun 17, 2026
- NVD status
- Modified