PT-2020-18764 · Nginx · Nginx Controller

Published 2020-03-27 · Updated 2022-04-22 · CVE-2020-5863

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions NGINX Controller versions prior to 3.2.0

Description An unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The created user is only able to upload a new license to the system but cannot view or modify any other components of the system.

Recommendations For NGINX Controller versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Controller API to prevent unauthenticated attackers from creating user accounts.

Fix

Related Identifiers

CVE-2020-5863

Affected Products

Nginx Controller

References · 5

• https://support.f5.com/csp/article/K14631834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5863 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5863 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20200430-0005 · Note
• https://t.me/cvenotify/2239 · Telegram Post