RCE in F5 Nginx Controller Api Management
CVE-2022-23008
On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.005 (41.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- F5 Nginx_controller_api_management
- N/a Nginx Controller Api Management — versions 3.18.0-3.19.0
Weakness classification (CWE)
References
- f5sirt@f5.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-23008?
- CVE-2022-23008 is a medium-severity vulnerability in F5 Nginx Controller Api Management, classified under Code Injection. CVSS score: 5.4/10. Published 2022-01-25.
- How severe is CVE-2022-23008?
- Medium severity. CVSS v3 base score is 5.4 out of 10.