BIG-IP APM
The Access Policy Manager module of the F5 BIG-IP platform, deployed at the network edge as an identity authentication gateway. It supports multiple role configurations including OAuth authorization server, resource server, and client.
Timeline (last 90 days)
The vulnerability only exists when BIG-IP APM is configured as an OAuth authorization server and the virtual server is simultaneously configured with both an APM access policy and an OAuth profile.
The vulnerability does not exist in the default configuration; exploiting it requires a virtual server configured with both an APM access policy and an OAuth profile, a point corroborated by Rapid7's analysis.
All Facts (2)
The vulnerability only exists when BIG-IP APM is configured as an OAuth authorization server and the virtual server is simultaneously configured with both an APM access policy and an OAuth profile.
50%UnverifiedThe vulnerability does not exist in the default configuration; exploiting it requires a virtual server configured with both an APM access policy and an OAuth profile, a point corroborated by Rapid7's analysis.
50%