Password Recovery Code Exposure in NGINX Controller by F5 Networks

CVE-2020-5899

Summary

In specific versions of NGINX Controller (3.0.0 to 3.4.0), a security flaw allows the recovery code needed for password resets to be stored in plain text in the database. This vulnerability can be exploited by an attacker with access to the database, enabling them to initiate password resets for other users by intercepting the recovery code associated with their email addresses. Unauthorized access to the database can lead to severe data breaches and compromise user accounts.

References