CVE-2017-6130 in SSL Intercept iApp

Summary

F5 SSL Intercept iApp 1.5.0 - 1.5.7 and SSL Orchestrator 2.0 is vulnerable to a Server-Side Request Forgery (SSRF) attack when deployed using the Dynamic Domain Bypass (DDB) feature feature plus SNAT Auto Map option for egress traffic.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Reservation: 02/21/2017
• Disclosure: 04/06/2017
• Moderation: VulDB entry created
• Entries: VDB-99341 (1)
• CPE: ready
• CWE: CWE-918 (Confirmed)
• CVSS: 7.2
• EPSS: 0.00344
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2017-6130
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2017-6130
• CVE Details: https://www.cvedetails.com/cve/CVE-2017-6130/