PT-2022-3993 · Nginx · Nginx Instance Manager

Published 2022-08-04 · Updated 2022-08-10 · CVE-2022-35241

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NGINX Instance Manager versions 1.x and earlier NGINX Instance Manager versions 2.x through 2.3.0

Description The issue is related to uncontrolled resource consumption. It may allow a remote attacker to cause a denial of service. In affected versions, undisclosed requests can cause an increase in disk resource utilization when NGINX Instance Manager is in use.

Recommendations For versions 1.x, there is no information about a newer version that contains a fix for this issue. For versions 2.x through 2.3.0, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the NGINX Instance Manager to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-04826

CVE-2022-35241

Affected Products

Nginx Instance Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-35241 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35241 · Vendor Advisory
• https://support.f5.com/csp/article/K37080719 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04826 · Security Note
• https://t.me/cibsecurity/47569 · Telegram Post
• https://support.f5.com/csp/article/K52125139 · Note