Session Management Flaw in NGINX Controller Webserver by F5
CVE-2020-5894

8.1HIGH

Key Information:

Vendor

F5
Status
Nginx Controller
Vendor
CVE Published:
7 May 2020

What is CVE-2020-5894?

The NGINX Controller webserver versions 3.0.0 to 3.3.0 has a session management flaw that fails to invalidate the server-side session token after a user logs out. This oversight could allow unauthorized access to user sessions, potentially exposing sensitive information or allowing unauthorized actions within the system. Proper session handling is crucial in safeguarding user data and maintaining the integrity of web applications. Organizations utilizing these affected versions should take immediate actions to mitigate this vulnerability, including upgrading to the latest version where this issue is resolved.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

NGINX Controller < 3.4.0

References

https://support.f5.com/csp/article/K13028514
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.