CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider (SP) connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via the SP connector.

• CWE-20

• http://www.securityfocus.com/bid/97168Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038131
• https://support.f5.com/csp/article/K95444512Vendor Advisory
• http://www.securityfocus.com/bid/97168Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038131
• https://support.f5.com/csp/article/K95444512Vendor Advisory

Published

Apr 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7461The drag-and-drop (aka DnD) function in VMware Workstation P…
• CVE-2016-7462The Suite REST API in VMware vRealize Operations (aka vROps)…
• CVE-2016-7463Cross-site scripting (XSS) vulnerability in the Host Client …
• CVE-2016-7464Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7465Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7466Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci…6
• CVE-2016-7468An unauthenticated remote attacker may be able to disrupt se…
• CVE-2016-7469A stored cross-site scripting (XSS) vulnerability in the Con…
• CVE-2016-7470Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-7471Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-7472F5 BIG-IP ASM version 12.1.0 - 12.1.1 may allow remote attac…
• CVE-2016-7473Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…