Improper Certificate Validation in NGINX Controller - CVE-2020-5909
Published: July 2, 2020 / Updated: December 17, 2020
Vulnerability identifier: #VU34177
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-5909
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
Affected software
NGINX Controller
How to mitigate CVE-2020-5909
Install update from vendor's website.
NGINX Controller - update to 3.6.0