High severity · published May 3, 2023
CVE-2023-28724
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API…
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Nginx Api Connectivity Manager · F5
1.0.0 before 1.5.0 · source: NVD
NI
Nginx Instance Manager · F5
2.0.0 before 2.9.0 · source: NVD
NS
Nginx Security Monitoring · F5
1.0.0 before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28724
Vendor Advisory
https://my.f5.com/manage/s/article/K000133233
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230609-0006/
More from Nginx Api Connectivity Manager
8.1
CVE-2023-28656
NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have…
5.4
CVE-2024-10318
A session fixation issue was discovered in the NGINX OpenID Connect reference implementation, where a nonce was not checked at login time