PT-2022-15775 · Nginx · Nginx Controller Api Management

Published 2022-01-25 · Updated 2023-06-27 · CVE-2022-23008

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NGINX Controller API Management versions 3.18.0 through 3.19.0

Description An authenticated attacker with access to the user or admin role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances.

Recommendations For NGINX Controller API Management versions 3.18.0 through 3.19.0, consider restricting access to undisclosed API endpoints to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling JavaScript code execution on managed NGINX data plane instances until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2022-23008

Affected Products

Nginx Controller Api Management

References · 5

• https://support.f5.com/csp/article/K57735782 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23008 · Security Note
• https://t.me/cvenotify/53171 · Telegram Post
• https://t.me/cibsecurity/36262 · Telegram Post