PT-2020-18808 · Nginx · Nginx Controller

Published 2020-07-02 · Updated 2021-07-21 · CVE-2020-5910

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NGINX Controller versions 1.0.1, 2.0.0 through 2.9.0, 3.0.0 through 3.5.0

Description The Neural Autonomic Transport System (NATS) messaging services used by the NGINX Controller do not require any form of authentication, allowing any successful connection to be authorized.

Recommendations For version 1.0.1, consider disabling the NATS messaging services until a patch is available. For versions 2.0.0 through 2.9.0, restrict access to the NATS messaging services to minimize the risk of exploitation. For versions 3.0.0 through 3.5.0, avoid using the NATS messaging services without proper authentication mechanisms in place until the issue is resolved.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-5910

Affected Products

Nginx Controller

References · 4

• https://support.f5.com/csp/article/K59209532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5910 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5910 · Vendor Advisory
• https://t.me/cvenotify/4800 · Telegram Post