F5 Nginx_controller
18 CVEs affecting F5 Nginx_controller. Latest disclosed: 2021-06-01. Critical: 2, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27730 | Critical | 9.8 | 2020-12-11 | In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities. |
CVE-2020-5901 | Critical | 9.6 | 2020-07-01 | In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admi… |
CVE-2020-5900 | High | 8.8 | 2020-07-01 | In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface. |
CVE-2020-5863 | High | 8.6 | 2020-03-27 | In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The u… |
CVE-2020-5894 | High | 8.1 | 2020-05-07 | On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out. |
CVE-2020-5867 | High | 8.1 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages |
CVE-2021-23019 | High | 7.8 | 2021-06-01 | The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support… |
CVE-2020-5899 | High | 7.8 | 2020-07-01 | In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an at… |
CVE-2020-5895 | High | 7.8 | 2020-05-07 | On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local s… |
CVE-2020-5910 | High | 7.5 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require… |
CVE-2021-23018 | High | 7.4 | 2021-06-01 | Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the clus… |
CVE-2020-5864 | High | 7.4 | 2020-04-23 | In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default. |
CVE-2020-5911 | High | 7.3 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu sy… |
CVE-2021-23021 | Medium | 5.5 | 2021-06-01 | The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644. |
CVE-2021-23020 | Medium | 5.5 | 2021-06-01 | The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys. |
CVE-2020-5866 | Medium | 5.5 | 2020-04-23 | In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as… |
CVE-2020-5909 | Medium | 5.4 | 2020-07-02 | In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the… |
CVE-2020-5865 | Medium | 4.8 | 2020-04-23 | In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communica… |