CVE-2016-6249
medium
F5 CVSS v3 Base Score
5.3
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score
0.1%
Exploitation probability in 30 days
Top 80% most likely to be exploited
Attack Characteristics
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Vulnerability Report
Generated by CyberWatcher
Description
F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext to /var/log/restjavad.0.log. It may allow local users to obtain sensitive information by reading these files.
CWE
CWE-200Affected Products
f5 big-ip access policy managerf5 big-ip advanced firewall managerf5 big-ip analyticsf5 big-ip application acceleration managerf5 big-ip application security managerf5 big-ip domain name systemf5 big-ip global traffic managerf5 big-ip link controllerf5 big-ip local traffic managerf5 big-ip policy enforcement manager