JavaScript Injection Vulnerability in NGINX Controller API Management by F5
CVE-2022-23008

5.4MEDIUM

Key Information:

Vendor
F5
Status
Nginx Controller Api Management
Vendor
CVE Published:
25 January 2022

Summary

On certain versions of NGINX Controller API Management, an authenticated attacker with user or admin privileges can exploit undisclosed API endpoints to inject malicious JavaScript code. This code is executed on associated NGINX data plane instances, leading to potential compromise of sensitive data and disruption of services. It is important to note that versions which have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Affected Version(s)

NGINX Controller API Management 3.18.0-3.19.0

References

https://support.f5.com/csp/article/K57735782
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.