UpHeron
All vulnerabilities

Servers and applications

CVE-2016-3687

Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter.

Severity
Medium 5.3
Published
16 Jun 2016
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
1.2% in the next 30 daysHigher than 68% of CVEs. EPSS by FIRST, 11 Nov 2026
Attack
Over the network · Only under certain conditions · No login needed · Needs someone to click or open something
Attacker can
Change data
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Sources
NVD

Affected software

SoftwareAffected versions
F5 BIG-IPServers and applications · cpe:a:f5:big-ip_access_policy_manager
  • Version 11.6.0
  • Version 11.5.4
  • Version 11.5.3
  • Version 11.5.2
All 9 release lines
  • Version 11.2.1
  • Version 11.4.0
  • Version 11.4.1
  • Version 11.5.0
  • Version 11.5.1
  • Version 11.5.2
  • Version 11.5.3
  • Version 11.5.4
  • Version 11.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3687
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3687