7.1
High
CVE-2023-28724 NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify…
Description
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NGINX Instance Manager 2.0 | 2.0.0 → < 2.9.0 | 2.9.0 |
| NGINX Instance Manager 1.0 | 1.0.0 → latest | No fix stated |
| NGINX API Connectivity Manager 1.0 | 1.0.0 → < 1.5.0 | 1.5.0 |
| NGINX Security Monitoring 1.0 | 1.0.0 → < 1.3.0 | 1.3.0 |
Other CVEs of NGINX Instance Manager
The 5 CVEs of NGINX Instance Manager →
CVE-2026-60062
The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files…
6.4
Medium
CVE-2024-10318
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not…
5.4
Medium
CVE-2023-28656
NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their…
8.1
High
CVE-2022-35241
In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can…
6.5
Medium