CVEvulnerability

CVE-2023-28724

7.1 HIGH Published 2023-05-03 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2023-05-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-276

Description

NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected configurations

• f5 nginx api connectivity manager (>= 1.0.0 < 1.5.0) • f5 nginx instance manager (>= 2.0.0 < 2.9.0) • f5 nginx security monitoring (>= 1.0.0 < 1.3.0)

Related

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References