Insecure Intra-cluster Communication in NGINX Controller Software by F5 Networks
CVE-2021-23018

7.4HIGH

Key Information:

Vendor

F5
Status
Nginx Controller
Vendor
CVE Published:
1 June 2021

What is CVE-2021-23018?

The NGINX Controller versions prior to 3.4.0 have a vulnerability that arises from intra-cluster communication being conducted without TLS encryption. This results in the potential exposure of sensitive data transmitted within the cluster, as it operates using unprotected cleartext protocols. Organizations using affected versions are advised to upgrade to mitigate security vulnerabilities associated with unencrypted communication.

Affected Version(s)

Nginx Controller "3.x before 3.4.0"

References

https://support.f5.com/csp/article/K97002210
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.