VulnerabilityModified

CVE-2016-6249

It may allow local users to obtain sensitive information by reading these files.

MEDIUM 5.3EPSS 0.33%

Does this matter?

Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.

Description

F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files.

CVSS 3.0: 5.3 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.33% probability · 27th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: f5/big-ip access policy manager · f5/big-ip advanced firewall manager · f5/big-ip analytics · f5/big-ip application acceleration manager · f5/big-ip application security manager · f5/big-ip domain name system · f5/big-ip global traffic manager · f5/big-ip link controller · f5/big-ip local traffic manager · f5/big-ip policy enforcement manager · f5/big-ip websafe
Source: f5sirt@f5.com

References

http://www.securitytracker.com/id/1037873
https://support.f5.com/csp/article/K12685114Vendor Advisory
http://www.securitytracker.com/id/1037873
https://support.f5.com/csp/article/K12685114Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.