Session Management Flaw in NGINX Controller Webserver by F5
CVE-2020-5894

8.1HIGH

Key Information:

Vendor
F5
Status
Nginx Controller
Vendor
CVE Published:
7 May 2020

Summary

The NGINX Controller webserver versions 3.0.0 to 3.3.0 has a session management flaw that fails to invalidate the server-side session token after a user logs out. This oversight could allow unauthorized access to user sessions, potentially exposing sensitive information or allowing unauthorized actions within the system. Proper session handling is crucial in safeguarding user data and maintaining the integrity of web applications. Organizations utilizing these affected versions should take immediate actions to mitigate this vulnerability, including upgrading to the latest version where this issue is resolved.

Affected Version(s)

NGINX Controller < 3.4.0

References

https://support.f5.com/csp/article/K13028514
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.