CVE-2020-5899: High severity f5 nginx controller api management vulnerability
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-5899?
CVE-2020-5899 is classified as a high severity vulnerability due to exposed sensitive information.
How do I fix CVE-2020-5899?
To fix CVE-2020-5899, upgrade NGINX Controller to a version above 3.4.0 where recovery codes are not stored in plain text.
What are the risks associated with CVE-2020-5899?
The risks of CVE-2020-5899 include unauthorized access to user accounts if the database is compromised.
Who is affected by CVE-2020-5899?
Organizations using NGINX Controller versions 3.0.0 to 3.4.0 are affected by CVE-2020-5899.
What types of attacks can exploit CVE-2020-5899?
Attackers can exploit CVE-2020-5899 through database interception or unauthorized database access to gain sensitive information.