CVE-2020-5900

published 2020-07-01

CVE-2020-5900: In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.

high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
f5	nginx_controller	—	—
f5	nginx_controller	—	—
f5	nginx_controller	—	—
f5	nginx_controller	2.0.0 – 2.9.0	—
f5	nginx_controller	3.0.0 – 3.4.0	—

CWE-352