CVE-2020-5867

CWE-319 — Cleartext TransmissionCWE-494CWE-20 — Improper Input Validation4 documents4 sources
Severity
8.1HIGH
EPSS
0.1%
top 64.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
F5 Nginx Controller
Timeline
PublishedApr 23
Latest updateMay 24

Description

In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5nginx_controller< 3.3.0
▶NVDf5/nginx_controller3.0.0 — 3.3.0+2

🔴Vulnerability Details

2
GHSA
GHSA-mrgg-hv86-p2g9: In versions prior to 3↗2022-05-24
▶
CVEList
CVE-2020-5867: In versions prior to 3↗2020-04-23
▶

📋Vendor Advisories

1
F5
CVE-2020-5867: In versions prior to 3↗2020-04-23
▶
CVE-2020-5867 (HIGH CVSS 8.1) | In versions prior to 3.3.0 | cvebase.io