iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.
References
Link | Resource |
---|---|
https://support.f5.com/csp/article/K22317030 | Mitigation Vendor Advisory |
https://support.f5.com/csp/article/K22317030 | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:29
Type | Values Removed | Values Added |
---|---|---|
References | () https://support.f5.com/csp/article/K22317030 - Mitigation, Vendor Advisory |
Information
Published : 2017-10-20 15:29
Updated : 2024-11-21 03:29
NVD link : CVE-2017-6145
Mitre link : CVE-2017-6145
CVE.ORG link : CVE-2017-6145
JSON object : View
Products Affected
f5
- big-ip_application_security_manager
- big-ip_application_acceleration_manager
- big-ip_policy_enforcement_manager
- big-ip_websafe
- big-ip_domain_name_system
- big-ip_link_controller
- big-ip_local_traffic_manager
- big-ip_advanced_firewall_manager
- big-ip_access_policy_manager
- big-ip_analytics
CWE
CWE-613
Insufficient Session Expiration