PT-2021-7435 · Nginx · Nginx Controller

Published 2021-06-01 · Updated 2022-08-30 · CVE-2021-23019

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Controller versions 2.0.0 through 2.9.0 NGINX Controller versions 3.x before 3.15.0

Description The issue is related to insufficient protection of registration data, which may allow an attacker to disclose protected information. Specifically, the Administrator password may be exposed in the systemd.txt file included in the NGINX support package.

Recommendations For NGINX Controller versions 2.0.0 through 2.9.0, update to version 3.15.0 or later to resolve the issue. For NGINX Controller versions 3.x before 3.15.0, update to version 3.15.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the systemd.txt file to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-201

CWE-522

Related Identifiers

BDU:2022-06213

CVE-2021-23019

Affected Products

Nginx Controller

References · 4

• https://support.f5.com/csp/article/K04884013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23019 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06213 · Security Note