Command Line Restriction Vulnerability in NGINX Ingress Controller by F5 Networks
CVE-2021-23055

6.5MEDIUM

Key Information:

Vendor

F5
Status
Nginx Ingress Controller
Vendor
CVE Published:
21 April 2022

What is CVE-2021-23055?

A command line restriction vulnerability exists in the NGINX Ingress Controller, affecting versions 1.x prior to 1.12.3 and 2.x prior to 2.0.3. This flaw allows the command line restriction for snippet usage to be bypassed when applied to Ingress objects, potentially exposing the system to unauthorized commands and execution. Software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Affected Version(s)

NGINX Ingress Controller 2.x before 2.0.3 and 1.x before 1.12.3

References

https://support.f5.com/csp/article/K01051452
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.