CVEvulnerability

CVE-2020-5910

7.5 HIGH Published 2020-07-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-07-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-306

Description

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.

Affected configurations

• f5 nginx controller (>= 2.0.0 <= 2.9.0) • f5 nginx controller (>= 3.0.0 <= 3.5.0) • f5 nginx controller 1.0.1

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References