F5 Networks Nginx Controller
Recent F5 Networks Nginx Controller Security Advisories
| Advisory | Title | Published |
|---|---|---|
| K57735782 | K57735782: NGINX Controller API Management vulnerability CVE-2020-23008 | January 19, 2022 |
| K36926027 | NGINX Controller vulnerability CVE-2021-23021 | May 25, 2021 |
| K45263486 | NGINX Controller vulnerability CVE-2021-23020 | May 25, 2021 |
| K04884013 | NGINX Controller vulnerability CVE-2021-23019 | May 25, 2021 |
By the Year
In 2024 there have been 0 vulnerabilities in F5 Networks Nginx Controller . Nginx Controller did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 4 | 6.55 |
| 2020 | 14 | 7.61 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Nginx Controller vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent F5 Networks Nginx Controller Security Vulnerabilities
The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file
CVE-2021-23019
7.8 - High
- June 01, 2021
The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.
Insufficiently Protected Credentials
The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm
CVE-2021-23020
5.5 - Medium
- June 01, 2021
The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys.
Use of Insufficiently Random Values
The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.
CVE-2021-23021
5.5 - Medium
- June 01, 2021
The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.
Incorrect Permission Assignment for Critical Resource
Intra-cluster communication does not use TLS
CVE-2021-23018
7.4 - High
- June 01, 2021
Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.
Cleartext Transmission of Sensitive Information
In versions 3.0.0-3.9.0
CVE-2020-27730
9.8 - Critical
- December 11, 2020
In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.
Directory traversal
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages
CVE-2020-5911
7.3 - High
- July 02, 2020
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection
CVE-2020-5910
7.5 - High
- July 02, 2020
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
authentification
In versions 3.0.0-3.5.0
CVE-2020-5909
5.4 - Medium
- July 02, 2020
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
Improper Certificate Validation
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack
CVE-2020-5901
9.6 - Critical
- July 01, 2020
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.
XSS
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which
CVE-2020-5899
7.8 - High
- July 01, 2020
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
Weak Password Recovery Mechanism for Forgotten Password
In versions 3.0.0-3.4.0
CVE-2020-5900
8.8 - High
- July 01, 2020
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
Session Riding
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which
CVE-2020-5895
7.8 - High
- May 07, 2020
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.
Incorrect Permission Assignment for Critical Resource
On versions 3.0.0-3.3.0
CVE-2020-5894
8.1 - High
- May 07, 2020
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
Session Fixation
In versions prior to 3.3.0
CVE-2020-5867
8.1 - High
- April 23, 2020
In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
Cleartext Transmission of Sensitive Information
In versions of NGINX Controller prior to 3.3.0, the helper.sh script
CVE-2020-5866
5.5 - Medium
- April 23, 2020
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
Information Disclosure
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception
CVE-2020-5865
4.8 - Medium
- April 23, 2020
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
Cleartext Transmission of Sensitive Information
In versions of NGINX Controller prior to 3.2.0
CVE-2020-5864
7.4 - High
- April 23, 2020
In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
Improper Certificate Validation
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API
CVE-2020-5863
8.6 - High
- March 27, 2020
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for NetApp Cloud Backup or by F5 Networks? Click the Watch button to subscribe.
