F5 Nginx Controller vulnerabilities

18 CVEs affecting F5 Nginx Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-23021, published 2021-06-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-27730, published 2020-12-11. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.
CVE-2020-5901, published 2020-07-01. Critical severity, CVSS 9.6. EPSS: 1.5% chance of exploitation in the next 30 days. In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete…
CVE-2020-5910, published 2020-07-02. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any…
CVE-2020-5863, published 2020-03-27. High severity, CVSS 8.6. EPSS: 1.2% chance of exploitation in the next 30 days. In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to…
CVE-2020-5864, published 2020-04-23. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
CVE-2020-5894, published 2020-05-07. High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days. On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
CVE-2020-5911, published 2020-07-02. High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days. In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.
CVE-2021-23018, published 2021-06-01. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.
CVE-2020-5867, published 2020-04-23. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
CVE-2020-5900, published 2020-07-01. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.

Latest

CVE-2021-23021, published 2021-06-01. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.
CVE-2021-23020, published 2021-06-01. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictable keys.
CVE-2021-23019, published 2021-06-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.
CVE-2020-5909, published 2020-07-02. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5899, published 2020-07-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database…