Password Recovery Code Exposure in NGINX Controller by F5 Networks
CVE-2020-5899

7.8HIGH

Key Information:

Vendor

F5
Status
Nginx Controller
Vendor
CVE Published:
1 July 2020

What is CVE-2020-5899?

In specific versions of NGINX Controller (3.0.0 to 3.4.0), a security flaw allows the recovery code needed for password resets to be stored in plain text in the database. This vulnerability can be exploited by an attacker with access to the database, enabling them to initiate password resets for other users by intercepting the recovery code associated with their email addresses. Unauthorized access to the database can lead to severe data breaches and compromise user accounts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

NGINX Controller 3.0.0-3.4.0

References

https://support.f5.com/csp/article/K25434422
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.