CVEvulnerability
CVE-2020-5865
4.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-04-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-319
Description
In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.
Affected configurations
• f5 nginx controller (>= 2.0.0 <= 2.9.0)
• f5 nginx controller (>= 3.0.0 < 3.3.0)
• f5 nginx controller 1.0.1
• netapp cloud backup
Related
Weakness · CWE (1)
- CWE-319 Cleartext Transmission of Sensitive Information weakness
References
- https://security.netapp.com/advisory/ntap-20200430-0005/ Third Party Advisory
- https://support.f5.com/csp/article/K21009022 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20200430-0005/ Third Party Advisory
- https://support.f5.com/csp/article/K21009022 Vendor Advisory