CVE-2020-5867: High severity f5 nginx controller api management vulnerability
Published Apr 23, 2020
·Updated
In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
Affected Software
4 affected components
F5 Nginx Controller>=2.0.0<=2.9.0
F5 Nginx Controller>=3.0.0<3.3.0
F5 Nginx Controller=1.0.1
NetApp Cloud Backup
Event History
Apr 23, 2020
CVE Published
via MITRE·07:58 PM
Data Sourced
via MITRE·07:58 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-5867?
CVE-2020-5867 is classified as a medium severity vulnerability due to its potential exploitation risks.
2
How do I fix CVE-2020-5867?
To fix CVE-2020-5867, upgrade the NGINX Controller to version 3.3.0 or later.
3
What versions are affected by CVE-2020-5867?
CVE-2020-5867 affects F5 NGINX Controller versions prior to 3.3.0 and specifically versions from 2.0.0 to 2.9.0 and 1.0.1.
4
What kind of risk does CVE-2020-5867 pose?
CVE-2020-5867 poses a risk of man-in-the-middle attacks due to the use of HTTP for package installation.
5
Is CVE-2020-5867 exploitable remotely?
Yes, CVE-2020-5867 can be exploited remotely if an attacker can intercept network traffic during the package installation process.