CVE-2013-3587
mediumpriority · track · 26EPSS 0.060 · 93 %ileDEEUNLUSEPSS · scored 2026-10-27
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (49)
Products and version ranges known to be affected.
- f5 big-ip access policy manager10.1.0 → 10.2.4nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager11.0.0 → 11.6.1nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager12.0.0 → 12.1.2nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager= 13.0.0nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager11.3.0 → 11.6.1nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager12.0.0 → 12.1.2nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager= 13.0.0nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip application acceleration manager11.4.0 → 11.6.1nvdUScpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
- f5 big-ip application acceleration manager12.0.0 → 12.1.2nvdUScpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
- f5 big-ip application acceleration manager= 13.0.0nvdUScpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
- f5 big-ip application security manager10.0.0 → 10.2.4nvdUScpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0378Kwetsbaarheden verholpen in SAP productenNL2024-09-19csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in diverse producten, zoals SAP, Business Warehouse, NetWeaver, HANA, Business Objects en Commerce.
- WID-SEC-W-2024-2086SAP Patchday September 2024Deutsch2024-09-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu erzeugen oder einen Cross-Site-Scripting-Angriff durchzuführen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (37)
External citations — patches, advisories, analysis.
- http://breachattack.com/cnnvd
- http://github.com/meldium/breach-mitigation-railscnnvd
- http://security.stackexchange.com/questions/20406/is-cnnvd
- http://slashdot.org/story/13/08/05/233216cnnvd
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdfcnnvd
- http://www.kb.cert.org/vuls/id/987798cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=995168cnnvd
- https://hackerone.com/reports/254895cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan