CVE-2013-3587
MEDIUMCVSS 5.9/10EPSS 6.05%
Last modified
CVE-2013-3587 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.. EPSS estimates a 6.05% chance of exploitation in the next 30 days.
Description
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| F5 | Big-Ip Access Policy Manager | >= 10.1.0, <= 10.2.4 |
| F5 | Big-Ip Access Policy Manager | >= 11.0.0, <= 11.6.1 |
| F5 | Big-Ip Access Policy Manager | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Access Policy Manager | 13.0.0 |
| F5 | Big-Ip Advanced Firewall Manager | >= 11.3.0, <= 11.6.1 |
| F5 | Big-Ip Advanced Firewall Manager | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Advanced Firewall Manager | 13.0.0 |
| F5 | Big-Ip Analytics | >= 11.0.0, <= 11.6.1 |
| F5 | Big-Ip Analytics | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Analytics | 13.0.0 |
| F5 | Big-Ip Application Acceleration Manager | >= 11.4.0, <= 11.6.1 |
| F5 | Big-Ip Application Acceleration Manager | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Application Acceleration Manager | 13.0.0 |
| F5 | Big-Ip Application Security Manager | >= 9.2.0, <= 9.4.8 |
| F5 | Big-Ip Application Security Manager | >= 10.0.0, <= 10.2.4 |
| F5 | Big-Ip Application Security Manager | >= 11.0.0, <= 11.6.1 |
| F5 | Big-Ip Application Security Manager | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Application Security Manager | 13.0.0 |
| F5 | Big-Ip Edge Gateway | >= 10.1.0, <= 10.2.4 |
| F5 | Big-Ip Edge Gateway | >= 11.0.0, <= 11.3.0 |
| F5 | Big-Ip Link Controller | >= 9.2.2, <= 9.4.8 |
| F5 | Big-Ip Link Controller | >= 10.0.0, <= 10.2.4 |
| F5 | Big-Ip Link Controller | >= 11.0.0, <= 11.6.1 |
| F5 | Big-Ip Link Controller | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Link Controller | 13.0.0 |
| F5 | Big-Ip Local Traffic Manager | >= 9.0.0, <= 9.6.1 |
| F5 | Big-Ip Local Traffic Manager | >= 10.0.0, <= 10.2.4 |
| F5 | Big-Ip Local Traffic Manager | >= 11.0.0, <= 11.6.1 |
| F5 | Big-Ip Local Traffic Manager | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Local Traffic Manager | 13.0.0 |
| F5 | Big-Ip Policy Enforcement Manager | >= 11.3.0, <= 11.6.1 |
| F5 | Big-Ip Policy Enforcement Manager | >= 12.0.0, <= 12.1.2 |
| F5 | Big-Ip Policy Enforcement Manager | 13.0.0 |
| F5 | Big-Ip Protocol Security Module | >= 9.4.5, <= 9.4.8 |
| F5 | Big-Ip Protocol Security Module | >= 10.0.0, <= 10.2.4 |
| F5 | Big-Ip Protocol Security Module | >= 11.0.0, <= 11.4.1 |
| F5 | Big-Ip Wan Optimization Manager | >= 10.0.0, <= 10.2.4 |
| F5 | Big-Ip Wan Optimization Manager | >= 11.0.0, <= 11.3.0 |
| F5 | Big-Ip Webaccelerator | >= 9.4.0, <= 9.4.8 |
| F5 | Big-Ip Webaccelerator | >= 10.0.0, <= 10.2.4 |
| F5 | Big-Ip Webaccelerator | >= 11.0.0, <= 11.3.0 |
| F5 | Firepass | >= 6.0.0, <= 6.1.0 |
| F5 | Firepass | 7.0.0 |
| F5 | Arx | >= 5.0.0, <= 5.3.1 |
| F5 | Arx | >= 6.0.0, <= 6.4.0 |
References
- http://breachattack.com/Third Party Advisory
- http://github.com/meldium/breach-mitigation-railsThird Party Advisory
- http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407Exploit, Third Party Advisory
- http://slashdot.org/story/13/08/05/233216Third Party Advisory
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdfThird Party Advisory
- http://www.kb.cert.org/vuls/id/987798Third Party Advisory, US Government Resource
- https://bugzilla.redhat.com/show_bug.cgi?id=995168Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/254895Exploit, Third Party Advisory
- https://support.f5.com/csp/article/K14634Third Party Advisory
- https://www.blackhat.com/us-13/briefings.html#PradoThird Party Advisory
- https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/Third Party Advisory
- http://breachattack.com/Third Party Advisory
- http://github.com/meldium/breach-mitigation-railsThird Party Advisory
- http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407Exploit, Third Party Advisory
- http://slashdot.org/story/13/08/05/233216Third Party Advisory
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdfThird Party Advisory
- http://www.kb.cert.org/vuls/id/987798Third Party Advisory, US Government Resource
- https://bugzilla.redhat.com/show_bug.cgi?id=995168Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/254895Exploit, Third Party Advisory
- https://support.f5.com/csp/article/K14634Third Party Advisory
- https://www.blackhat.com/us-13/briefings.html#PradoThird Party Advisory
- https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-3587?
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
How severe is CVE-2013-3587?
CVE-2013-3587 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 6.05% probability of exploitation in the next 30 days.
How do I fix CVE-2013-3587?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-3581ajax.cgi in the web interface on the Choice Wireless Green P…
- CVE-2013-3582Buffer overflow in Dell BIOS on Dell Latitude D###, E####, X…
- CVE-2013-3583Cross-site request forgery (CSRF) vulnerability in savePrope…
- CVE-2013-3584Cross-site scripting (XSS) vulnerability in Corporater EPM S…
- CVE-2013-3585Samsung Web Viewer for Samsung DVR devices stores credential…
- CVE-2013-3586Samsung Web Viewer for Samsung DVR devices allows remote att…
- CVE-2013-3588The web management interface on Zyxel P660 devices allows re…
- CVE-2013-3589Cross-site scripting (XSS) vulnerability in the login page i…
- CVE-2013-3590Unrestricted file upload vulnerability in admin/uploadImage.…
- CVE-2013-3591vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP …8.8
- CVE-2013-3593Baramundi Management Suite 7.5 through 8.9 uses cleartext fo…
- CVE-2013-3594The SSH service on Dell PowerConnect 3348 1.2.1.3, 3524p 2.0…
Are you affected by CVE-2013-3587?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST