F5 NGINX Controller 3.4.0

CPE Details

F5 NGINX Controller 3.4.0
f5
nginx_controller
3.4.0
2020-05-20
14h48 +00:00
2020-05-20
14h48 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:f5:nginx_controller:3.4.0:*:*:*:*:*:*:*

Informations

Vendor

f5

Product

nginx_controller

Version

3.4.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-23021 2021-06-01 10h23 +00:00 The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.
5.5
Medium
CVE-2021-23020 2021-06-01 10h14 +00:00 The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys.
5.5
Medium
CVE-2021-23019 2021-06-01 10h03 +00:00 The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.
7.8
High
CVE-2021-23018 2021-06-01 09h51 +00:00 Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.
7.4
High
CVE-2020-27730 2020-12-11 18h03 +00:00 In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.
9.8
Critical
CVE-2020-5909 2020-07-02 10h26 +00:00 In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
5.4
Medium
CVE-2020-5910 2020-07-02 10h25 +00:00 In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
7.5
High
CVE-2020-5911 2020-07-02 10h23 +00:00 In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.
7.3
High
CVE-2020-5901 2020-07-01 12h03 +00:00 In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.
9.6
Critical
CVE-2020-5899 2020-07-01 12h01 +00:00 In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
7.8
High
CVE-2020-5900 2020-07-01 11h59 +00:00 In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
8.8
High