F5 Nginx Controller vulnerabilities

CVE-2022-23008 [MEDIUM] CWE-79 CVE-2022-23008: On NGINX Controller API Management versions 3 CVE-2022-23008: On NGINX Controller API Management versions 3 On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Suppor

CVE-2021-23019 [HIGH] CWE-201 CVE-2021-23019: The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.

CVE-2021-23018 [HIGH] CWE-319 CVE-2021-23018: Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3. Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.

CVE-2021-23021 [MEDIUM] CWE-732 CVE-2021-23021: The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is w The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.

CVE-2021-23020 [MEDIUM] CWE-330 CVE-2021-23020: The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashin The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys.

CVE-2020-27730 [CRITICAL] CWE-22 CVE-2020-27730: In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute pa In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

CVE-2020-5911 [HIGH] CVE-2020-5911: In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.

CVE-2020-5910 [HIGH] CWE-306 CVE-2020-5910: In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messag In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.

CVE-2020-5909 [MEDIUM] CWE-295 CVE-2020-5909: In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Contr In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.

CVE-2020-5901 [CRITICAL] CWE-79 CVE-2020-5901: In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scri In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.

CVE-2020-5900 [HIGH] CWE-352 CVE-2020-5900: In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (C In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.

CVE-2020-5899 [HIGH] CWE-312 CVE-2020-5899: In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted a In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code

CVE-2020-5895 [HIGH] CWE-732 CVE-2020-5895: On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.

CVE-2020-5894 [HIGH] CWE-384 CVE-2020-5894: On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.

CVE-2020-5864 [HIGH] CWE-295 CVE-2020-5864: In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plu In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.

CVE-2020-5867 [HIGH] CWE-319 CVE-2020-5867: In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP inste In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages

CVE-2020-5866 [MEDIUM] CWE-200 CVE-2020-5866: In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NG In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.

CVE-2020-5865 [MEDIUM] CWE-319 CVE-2020-5865: In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres data In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.

CVE-2020-5863 [HIGH] CVE-2020-5863: In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.