Vulnerabilities > F5 > Nginx Controller

DATE CVE VULNERABILITY TITLE RISK
2020-07-01 CVE-2020-5900 Cross-Site Request Forgery (CSRF) vulnerability in F5 Nginx Controller
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
network
low complexity
f5 CWE-352
8.8
2020-05-07 CVE-2020-5895 Incorrect Permission Assignment for Critical Resource vulnerability in F5 Nginx Controller 3.1.0/3.2.0/3.3.0
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket.
local
low complexity
f5 CWE-732
7.8
2020-05-07 CVE-2020-5894 Session Fixation vulnerability in F5 Nginx Controller
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
network
low complexity
f5 CWE-384
8.1
2020-04-23 CVE-2020-5867 Download of Code Without Integrity Check vulnerability in multiple products
In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
network
high complexity
f5 netapp CWE-494
8.1
2020-04-23 CVE-2020-5866 Information Exposure vulnerability in F5 Nginx Controller
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
local
low complexity
f5 CWE-200
5.5
2020-04-23 CVE-2020-5865 Cleartext Transmission of Sensitive Information vulnerability in multiple products
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
network
high complexity
f5 netapp CWE-319
4.8
2020-04-23 CVE-2020-5864 Improper Certificate Validation vulnerability in F5 Nginx Controller
In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
network
high complexity
f5 CWE-295
7.4
2020-03-27 CVE-2020-5863 In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts.
network
low complexity
f5 netapp
8.6