CVE-2020-5866: Infoleak
Published Apr 23, 2020
·Updated
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
Affected Software
3 affected components
F5 Nginx Controller>=2.0.0<=2.9.0
F5 Nginx Controller>=3.0.0<3.3.0
F5 Nginx Controller=1.0.1
Event History
Apr 23, 2020
CVE Published
via MITRE·06:37 PM
Data Sourced
via MITRE·06:37 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-5866.
2
What is the severity of CVE-2020-5866?
The severity of CVE-2020-5866 is medium, with a severity value of 5.5.
3
What is the affected software for CVE-2020-5866?
The affected software for CVE-2020-5866 is F5 Nginx Controller versions 2.0.0 to 2.9.0, versions 3.0.0 to 3.3.0, and version 1.0.1.
4
What is the description of CVE-2020-5866?
In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.
5
How do I fix CVE-2020-5866?
To fix CVE-2020-5866, update to NGINX Controller version 3.3.0 or later.