CVE-2017-6145 - Vulnerability Details

Vendors	Products
F5	Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics Big-ip Application Acceleration Manager Big-ip Application Security Manager Big-ip Domain Name System Big-ip Link Controller Big-ip Local Traffic Manager Big-ip Policy Enforcement Manager Big-ip Websafe

Link	Providers
https://support.f5.com/csp/article/K22317030

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe", "vendor": "F5 Networks, Inc.", "versions": [{"status": "affected", "version": "12.0.0 through 12.1.2"}, {"status": "affected", "version": "13.0.0"}]}], "datePublic": "2017-07-12T00:00:00", "descriptions": [{"lang": "en", "value": "iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens."}], "problemTypes": [{"descriptions": [{"description": "Cookie verification vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-20T14:57:01", "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.f5.com/csp/article/K22317030"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "f5sirt@f5.com", "DATE_PUBLIC": "2017-07-12T00:00:00", "ID": "CVE-2017-6145", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe", "version": {"version_data": [{"version_value": "12.0.0 through 12.1.2"}, {"version_value": "13.0.0"}]}}]}, "vendor_name": "F5 Networks, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cookie verification vulnerability"}]}]}, "references": {"reference_data": [{"name": "https://support.f5.com/csp/article/K22317030", "refsource": "CONFIRM", "url": "https://support.f5.com/csp/article/K22317030"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T15:18:49.878Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.f5.com/csp/article/K22317030"}]}]}, "cveMetadata": {"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "assignerShortName": "f5", "cveId": "CVE-2017-6145", "datePublished": "2017-10-20T15:00:00Z", "dateReserved": "2017-02-21T00:00:00", "dateUpdated": "2024-09-16T23:10:40.872Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe (string)

vendor : F5 Networks, Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 12.0.0 through 12.1.2 (string)

}

1 : { »

status : affected (string)

version : 13.0.0 (string)

}

]

}

]

datePublic : 2017-07-12T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Cookie verification vulnerability (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-10-20T14:57:01 (string)

orgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

shortName : f5 (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://support.f5.com/csp/article/K22317030 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : f5sirt@f5.com (string)

DATE_PUBLIC : 2017-07-12T00:00:00 (string)

ID : CVE-2017-6145 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe (string)

version : { »

version_data : [ »

0 : { »

version_value : 12.0.0 through 12.1.2 (string)

}

1 : { »

version_value : 13.0.0 (string)

}

]

}

]

}

vendor_name : F5 Networks, Inc. (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Cookie verification vulnerability (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://support.f5.com/csp/article/K22317030 (string)

refsource : CONFIRM (string)

url : https://support.f5.com/csp/article/K22317030 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T15:18:49.878Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://support.f5.com/csp/article/K22317030 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 9dacffd4-cb11-413f-8451-fbbfd4ddc0ab (string)

assignerShortName : f5 (string)

cveId : CVE-2017-6145 (string)

datePublished : 2017-10-20T15:00:00Z (string)

dateReserved : 2017-02-21T00:00:00 (string)

dateUpdated : 2024-09-16T23:10:40.872Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "FCD2044C-AC6F-4145-B1A0-8EB26DCF1F8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "5FC866D4-CE8C-4408-AD1E-8643AC554CC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "7563D979-BE37-4251-B92E-0DBDBE53F3FF", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "BCF89E7C-806E-4800-BAA9-0225433B6C56", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "BC827031-CA39-4081-8CE0-30EAC78DF756", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "7569903B-3A15-4A10-863B-6828337DD268", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "45825991-D17D-42F1-87B4-7DF86B098B45", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "8C4E5F36-434B-48E1-9715-4EEC22FB23D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "77192AFB-B612-4BAA-916C-3DF8E851CC2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "AE295AF6-2B35-467F-8501-B5753CDDE16C", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E3C03B68-914F-4DB0-A832-B626B8746524", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_analytics:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "34D75E7F-B65F-421D-92EE-6B20756019C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "ECA90FB8-E2CD-400F-B753-1B482E7FAC96", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "6FEC804B-35DB-4A0C-9AEA-15527E0CC1B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "BEB228A9-0C01-4531-B2B2-38BB7B0E02E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3D75D5AD-C20A-4D94-84E0-E695C9D2A26D", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "2DB2118A-0F9C-4273-BB07-85FEA32C785B", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8541C9EF-69A8-4641-B173-3BCE0EDD20A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E24A3C71-0075-4738-B114-267337D050CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "7569977A-E567-4115-B00C-4B0CBA86582E", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "55DD7394-BD0A-42FD-A367-827F35397A20", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "98509F74-301A-4D1F-A2B4-B01B80CEFFCA", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "E87FFF5F-5BB1-4E2F-BD15-3BA7C9B26FEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3F2F72B2-84F2-4FA2-9B53-E98344235EB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "BBBB6E7C-DA1A-479F-9DD2-DE0C3CA82E92", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "4913B437-33FF-4B5E-A855-9DA00B35E3B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "EDCFE65B-340B-4F7D-93A1-4390BBC8E67F", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_link_controller:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E2C4414E-8016-48B5-8CC3-F97FF2D85922", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "A82C7B1C-E195-4D94-B604-78FB464C4F81", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8F6C3144-D0DE-4248-BFCD-04A7E6104044", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "0357B5ED-0600-4756-93E5-692987068596", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "BA7D64DC-7271-4617-BD46-99C8246779CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "64273A2C-E5A1-4605-92DD-EBECC7F051D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "E60CA151-1C3A-45B3-B939-E6F80063C595", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "58BAD5A9-9C67-4056-9344-07C8C42C8E88", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "42821916-E601-4831-B37B-3202ACF2C562", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "16A05340-0AE2-49CA-903F-44383421577E", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "583F134E-1616-44F2-8EF0-0CFA5CCEF0AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:12.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "86D0731D-E9DA-4056-9AC6-F204C2F915F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:big-ip_websafe:13.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B2E56D76-1A89-46AB-9C17-CB24662FFDE7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens."}, {"lang": "es", "value": "iControl REST en F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe 12.0.0 hasta la versi\u00f3n 12.1.2 y 13.0.0 incluye un servicio para convertir las cookies de autorizaci\u00f3n BIGIPAuthCookie en tokens X-F5-Auth-Token. Este servicio no revalida correctamente las cookies cuando se realiza la conversi\u00f3n, permitiendo que cookies que fueron v\u00e1lidas otrora, pero que ahora han caducado, se conviertan en tokens v\u00e1lidos."}], "id": "CVE-2017-6145", "lastModified": "2024-11-21T03:29:08.440", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-20T15:29:00.457", "references": [{"source": "f5sirt@f5.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://support.f5.com/csp/article/K22317030"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://support.f5.com/csp/article/K22317030"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : FCD2044C-AC6F-4145-B1A0-8EB26DCF1F8C (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 5FC866D4-CE8C-4408-AD1E-8643AC554CC9 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 7563D979-BE37-4251-B92E-0DBDBE53F3FF (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:f5:big-ip_access_policy_manager:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : BCF89E7C-806E-4800-BAA9-0225433B6C56 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : BC827031-CA39-4081-8CE0-30EAC78DF756 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 7569903B-3A15-4A10-863B-6828337DD268 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 45825991-D17D-42F1-87B4-7DF86B098B45 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:f5:big-ip_advanced_firewall_manager:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 8C4E5F36-434B-48E1-9715-4EEC22FB23D1 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 77192AFB-B612-4BAA-916C-3DF8E851CC2B (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : AE295AF6-2B35-467F-8501-B5753CDDE16C (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : E3C03B68-914F-4DB0-A832-B626B8746524 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:f5:big-ip_analytics:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 34D75E7F-B65F-421D-92EE-6B20756019C2 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : ECA90FB8-E2CD-400F-B753-1B482E7FAC96 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 6FEC804B-35DB-4A0C-9AEA-15527E0CC1B1 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : BEB228A9-0C01-4531-B2B2-38BB7B0E02E9 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:f5:big-ip_application_acceleration_manager:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 3D75D5AD-C20A-4D94-84E0-E695C9D2A26D (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 2DB2118A-0F9C-4273-BB07-85FEA32C785B (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 8541C9EF-69A8-4641-B173-3BCE0EDD20A8 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : E24A3C71-0075-4738-B114-267337D050CD (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:f5:big-ip_application_security_manager:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 7569977A-E567-4115-B00C-4B0CBA86582E (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 55DD7394-BD0A-42FD-A367-827F35397A20 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 98509F74-301A-4D1F-A2B4-B01B80CEFFCA (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : E87FFF5F-5BB1-4E2F-BD15-3BA7C9B26FEA (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:f5:big-ip_domain_name_system:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 3F2F72B2-84F2-4FA2-9B53-E98344235EB6 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : BBBB6E7C-DA1A-479F-9DD2-DE0C3CA82E92 (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 4913B437-33FF-4B5E-A855-9DA00B35E3B3 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : EDCFE65B-340B-4F7D-93A1-4390BBC8E67F (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:f5:big-ip_link_controller:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : E2C4414E-8016-48B5-8CC3-F97FF2D85922 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : A82C7B1C-E195-4D94-B604-78FB464C4F81 (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 8F6C3144-D0DE-4248-BFCD-04A7E6104044 (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 0357B5ED-0600-4756-93E5-692987068596 (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:f5:big-ip_local_traffic_manager:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : BA7D64DC-7271-4617-BD46-99C8246779CA (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 64273A2C-E5A1-4605-92DD-EBECC7F051D5 (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : E60CA151-1C3A-45B3-B939-E6F80063C595 (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 58BAD5A9-9C67-4056-9344-07C8C42C8E88 (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:f5:big-ip_policy_enforcement_manager:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 42821916-E601-4831-B37B-3202ACF2C562 (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:f5:big-ip_websafe:12.1.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 16A05340-0AE2-49CA-903F-44383421577E (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:f5:big-ip_websafe:12.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 583F134E-1616-44F2-8EF0-0CFA5CCEF0AC (string)

vulnerable : true (boolean)

}

38 : { »

criteria : cpe:2.3:a:f5:big-ip_websafe:12.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 86D0731D-E9DA-4056-9AC6-F204C2F915F7 (string)

vulnerable : true (boolean)

}

39 : { »

criteria : cpe:2.3:a:f5:big-ip_websafe:13.0.0:*:*:*:*:*:*:* (string)

matchCriteriaId : B2E56D76-1A89-46AB-9C17-CB24662FFDE7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens. (string)

}

1 : { »

lang : es (string)

value : iControl REST en F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM y WebSafe 12.0.0 hasta la versión 12.1.2 y 13.0.0 incluye un servicio para convertir las cookies de autorización BIGIPAuthCookie en tokens X-F5-Auth-Token. Este servicio no revalida correctamente las cookies cuando se realiza la conversión, permitiendo que cookies que fueron válidas otrora, pero que ahora han caducado, se conviertan en tokens válidos. (string)

}

]

id : CVE-2017-6145 (string)

lastModified : 2024-11-21T03:29:08.440 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 7.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : LOW (string)

baseScore : 7.3 (number)

baseSeverity : HIGH (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-10-20T15:29:00.457 (string)

references : [ »

0 : { »

source : f5sirt@f5.com (string)

tags : [ »

0 : Mitigation (string)

1 : Vendor Advisory (string)

]

url : https://support.f5.com/csp/article/K22317030 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mitigation (string)

1 : Vendor Advisory (string)

]

url : https://support.f5.com/csp/article/K22317030 (string)

}

]

sourceIdentifier : f5sirt@f5.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-613 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object