Not rated
CVE-2020-5863 In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can…
Description
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX Controller | Versions not published |
References
- support.f5.com support.f5.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of NGINX Controller
The 18 CVEs of NGINX Controller →
CVE-2021-23021
The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with…
Not rated
CVE-2021-23020
The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which…
Not rated
CVE-2021-23019
The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt…
Not rated
CVE-2021-23018
Intra-cluster communication does not use TLS
Not rated