Information disclosure in F5 Big-Ip Access Policy Manager
CVE-2016-2084
F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, 11.6.0 before build 6.204.442, and 12.0.0 before build 1.14.628; BIG-IP AAM 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, 11.6.0 before build 6.204.442, and 12.0.0 before build 1.14.628; BIG-IP DNS 12.0.0 before build 1.14.628; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0; BIG-IP GTM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build 10.104.180, 11.5.2 before 11.5.4 build 0.1.256, and 11.6.0 before build 6.204.442; BIG-IP PSM 11.3.x and 11.4.x before 11.4.1 build 685-HF10; BIG-IQ Cloud, Device, and Security 4.2.0 through 4.5.0; and BIG-IQ ADC 4.5.0 do not properly regenerate certificates and keys when deploying cloud images in Amazon Web Services (AWS), Azure or Verizon cloud services environments, which allows attackers to obtain sensitive information or cause a denial of service (disruption) by leveraging a target instance configuration.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- F5 Big-Ip Access Policy Manager — versions 11.3.0, 11.4.0, 11.4.1
- F5 Big-Ip Advanced Firewall Manager — versions 11.3.0, 11.4.0, 11.4.1
- F5 Big-Ip Analytics — versions 11.3.0, 11.4.0, 11.4.1
- F5 Big-Ip Application Acceleration Manager — versions 11.4.1, 11.5.0, 11.5.1
- F5 Big-Ip Application Security Manager — versions 11.3.0, 11.4.0, 11.4.1
- F5 Big-Ip Domain Name System — versions 12.0.0
- F5 Big-Ip Edge Gateway — versions 11.3.0
- F5 Big-Ip Global Traffic Manager — versions 11.3.0, 11.4.0, 11.4.1
- F5 Big-Ip Link Controller — versions 11.3.0, 11.4.0, 11.4.1
- F5 Big-Ip Local Traffic Manager — versions 11.3.0, 11.4.0, 11.4.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securitytracker.com/id/1035520 (vdb-entry)
- support.f5.com/kb/en-us/solutions/public/k/11/sol11772107.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2016-2084?
- CVE-2016-2084 is a high-severity vulnerability in F5 Big-Ip Access Policy Manager, classified under Information Disclosure. CVSS score: 7.4/10. Published 2016-04-13.
- How severe is CVE-2016-2084?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2016-2084 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.