Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2017-6145
HistoryOct 20, 2017 - 3:29 p.m.

CVE-2017-6145

2017-10-2015:29:00
CWE-613
[email protected]
web.nvd.nist.gov
1

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

43.2%

JSON

iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.

Affected configurations

NVD
Node
f5big-ip_access_policy_managerMatch12.1.0
OR
f5big-ip_access_policy_managerMatch12.1.1
OR
f5big-ip_access_policy_managerMatch12.1.2
OR
f5big-ip_access_policy_managerMatch13.0.0
OR
f5big-ip_advanced_firewall_managerMatch12.1.0
OR
f5big-ip_advanced_firewall_managerMatch12.1.1
OR
f5big-ip_advanced_firewall_managerMatch12.1.2
OR
f5big-ip_advanced_firewall_managerMatch13.0.0
OR
f5big-ip_analyticsMatch12.1.0
OR
f5big-ip_analyticsMatch12.1.1
OR
f5big-ip_analyticsMatch12.1.2
OR
f5big-ip_analyticsMatch13.0.0
OR
f5big-ip_application_acceleration_managerMatch12.1.0
OR
f5big-ip_application_acceleration_managerMatch12.1.1
OR
f5big-ip_application_acceleration_managerMatch12.1.2
OR
f5big-ip_application_acceleration_managerMatch13.0.0
OR
f5big-ip_application_security_managerMatch12.1.0
OR
f5big-ip_application_security_managerMatch12.1.1
OR
f5big-ip_application_security_managerMatch12.1.2
OR
f5big-ip_application_security_managerMatch13.0.0
OR
f5big-ip_domain_name_systemMatch12.1.0
OR
f5big-ip_domain_name_systemMatch12.1.1
OR
f5big-ip_domain_name_systemMatch12.1.2
OR
f5big-ip_domain_name_systemMatch13.0.0
OR
f5big-ip_link_controllerMatch12.1.0
OR
f5big-ip_link_controllerMatch12.1.1
OR
f5big-ip_link_controllerMatch12.1.2
OR
f5big-ip_link_controllerMatch13.0.0
OR
f5big-ip_local_traffic_managerMatch12.1.0
OR
f5big-ip_local_traffic_managerMatch12.1.1
OR
f5big-ip_local_traffic_managerMatch12.1.2
OR
f5big-ip_local_traffic_managerMatch13.0.0
OR
f5big-ip_policy_enforcement_managerMatch12.1.0
OR
f5big-ip_policy_enforcement_managerMatch12.1.1
OR
f5big-ip_policy_enforcement_managerMatch12.1.2
OR
f5big-ip_policy_enforcement_managerMatch13.0.0
OR
f5big-ip_websafeMatch12.1.0
OR
f5big-ip_websafeMatch12.1.1
OR
f5big-ip_websafeMatch12.1.2
OR
f5big-ip_websafeMatch13.0.0

Related

f5 1
nessus 1
cve 1
prion 1
cvelist 1
f5
f5
K22317030 : iControl REST vulnerability CVE-2017-6145
2017-07-13 00:00:00
nessus
nessus
F5 Networks BIG-IP : iControl REST vulnerability (K22317030)
2017-07-13 00:00:00
cve
cve
CVE-2017-6145
2017-10-20 15:29:00
prion
prion
Authorization
2017-10-20 15:29:00
cvelist
cvelist
CVE-2017-6145
2017-07-12 00:00:00

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

43.2%

JSON
Related for NVD:CVE-2017-6145
f51nessus1cve1prion1cvelist1