Medium severity · published Apr 23, 2020
CVE-2020-5866
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line…
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
Nginx Controller · F5
2.0.0 through 2.9.0; 3.0.0 before 3.3.0; 1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5866
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5866
security.netapp.com
https://security.netapp.com/advisory/ntap-20200430-0005/
Vendor Advisory
https://support.f5.com/csp/article/K11922628
More from Nginx Controller
9.8
CVE-2020-27730
In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities
9.6
CVE-2020-5901
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack
8.8
CVE-2020-5900
In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface
8.6
CVE-2020-5863
In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts
8.1
CVE-2020-5894
On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out