{"id":"CVE-2017-6145","aliases":["EUVD-2017-15210","GHSA-mfh8-v6rj-qxf5"],"status":"published","title":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and...","description":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01053,"percentile":0.64589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2017-10-20T15:00:00Z","modified":"2026-06-17T01:21:50Z","products":[{"vendor":"f5","product":"big-ip_access_policy_manager"},{"vendor":"f5","product":"big-ip_advanced_firewall_manager"},{"vendor":"f5","product":"big-ip_analytics"},{"vendor":"f5","product":"big-ip_application_acceleration_manager"},{"vendor":"f5","product":"big-ip_application_security_manager"},{"vendor":"f5","product":"big-ip_domain_name_system"},{"vendor":"f5","product":"big-ip_link_controller"},{"vendor":"f5","product":"big-ip_local_traffic_manager"},{"vendor":"f5","product":"big-ip_policy_enforcement_manager"},{"vendor":"f5","product":"big-ip_websafe"},{"vendor":"f5 networks, inc.","product":"f5 big-ip ltm, aam, afm, analytics, apm, asm, dns, link controller, pem, websafe"}],"references":[{"url":"https://support.f5.com/csp/article/K22317030","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6145"},{"url":"https://github.com/advisories/GHSA-mfh8-v6rj-qxf5"}],"sources":{"cve":[{"id":"CVE-2017-6145","description":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.","status":"published","published":"2017-10-20T15:00:00Z","modified":"2024-09-16T23:10:40.872Z","updated_at":"2026-11-02T14:33:16.916541Z"}],"euvd":[{"id":"EUVD-2017-15210","description":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.","status":"published","published":"2017-10-20T15:00:00Z","modified":"2024-09-16T23:10:40Z","updated_at":"2026-11-03T00:54:56.209754Z"}],"ghsa":[{"id":"GHSA-mfh8-v6rj-qxf5","title":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and...","description":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.","status":"published","published":"2022-05-17T00:23:45Z","modified":"2023-02-03T05:01:35Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:53:00.497966Z"}],"nvd":[{"id":"CVE-2017-6145","description":"iControl REST in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe 12.0.0 through 12.1.2 and 13.0.0 includes a service to convert authorization BIGIPAuthCookie cookies to X-F5-Auth-Token tokens. This service does not properly re-validate cookies when making that conversion, allowing once-valid but now expired cookies to be converted to valid tokens.","status":"published","published":"2017-10-20T15:29:00.457Z","modified":"2026-06-17T01:21:50.32Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:04:03.426231Z"}]}}