Server-Side Request Forgery Vulnerability in F5 SSL Intercept iApp and SSL Orchestrator
CVE-2017-6130

7.4HIGH

Key Information:

Vendor

F5 Networks

Status
Ssl Intercept Iapp 1.5.0 - 1.5.7 And Ssl Orchestrator 2.0
Vendor
CVE Published:
6 April 2017

What is CVE-2017-6130?

The F5 SSL Intercept iApp and SSL Orchestrator are susceptible to Server-Side Request Forgery (SSRF) exploits when utilizing the Dynamic Domain Bypass (DDB) feature in conjunction with the SNAT Auto Map option for outbound traffic. This vulnerability could allow an attacker to make unauthorized requests, potentially leading to the disclosure of sensitive information or further exploitation of the network.

Affected Version(s)

SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0

References

https://support.f5.com/csp/article/K23001529
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.