What is CVE-2020-5910?

CVE-2020-5910 is a high-severity vulnerability in F5 Nginx_controller, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2020-07-02.

How severe is CVE-2020-5910?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in F5 Nginx_controller

CVE-2020-5910

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.

Vulnerability class: Broken Authentication

EPSS: 0.012 (63.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

F5 Nginx_controller — versions 1.0.1
N/a Nginx Controller — versions 3.0.0-3.5.0, 2.0.0-2.9.0, 1.0.1

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

f5sirt@f5.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-5910?: CVE-2020-5910 is a high-severity vulnerability in F5 Nginx_controller, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2020-07-02.
How severe is CVE-2020-5910?: High severity. CVSS v3 base score is 7.5 out of 10.