CVE-2020-27730

published 2020-12-11

CVE-2020-27730: In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
f5	nginx_controller	—	—
f5	nginx_controller	—	—
f5	nginx_controller	—	—
f5	nginx_controller	2.0.0 – 2.9.0	—
f5	nginx_controller	>= 3.0.0 < 3.10.0	3.10.0

CWE-22