CVE-2021-23055

6.5MEDIUM

Key Information:

Vendor
F5
Status
Nginx Ingress Controller
Vendor
CVE Published:
21 April 2022

Summary

On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Version(s)

NGINX Ingress Controller 2.x before 2.0.3 and 1.x before 1.12.3

References

https://support.f5.com/csp/article/K01051452
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.