CVE-2016-3687

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-16 · updated 2026-06-17

Description

Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter.

Affected products

F5 BIG-IP APM: 11.2.1, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.2 (+3)
F5 Big-Ip Edge Gateway: 11.2.1

References

http://www.securitytracker.com/id/1036111
https://support.f5.com/kb/en-us/solutions/public/k/26/sol26738102.html
http://www.securitytracker.com/id/1036111
https://support.f5.com/kb/en-us/solutions/public/k/26/sol26738102.html

Get alerted when CVE-2016-3687 or the next vulnerability affects your stack