CVE-2017-6143

X509 certificate verification was not correctly implemented in the IP Intelligence Subscription and IP Intelligence feed-list features, and thus the remote server's identity is not properly validated in F5 BIG-IP 12.0.0-12.1.2, 11.6.0-11.6.2, or 11.5.0-11.5.5.

Published: Apr 13, 2018
Updated: Apr 13, 2023
CVE: CVE-2017-6143
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Medium
Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N

CWEs:

CWE-295

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
f5 / big-ip_advanced_firewall_manager	12.1.0	12.1.2.x
f5 / big-ip_advanced_firewall_manager	11.6.1	11.6.2.x
f5 / big-ip_advanced_firewall_manager	11.5.1	11.5.5.x
f5 / big-ip_application_security_manager	11.6.1	11.6.2.x
f5 / big-ip_application_security_manager	11.5.1	11.5.5.x
f5 / big-ip_application_security_manager	12.1.0.x	12.1.2.x

https://support.f5.com/csp/article/K11464209

Vulnerability Database

289,784

CVE-2017-6143