NGINX Management Suite vulnerability
CVE-2023-28724

7.1HIGH

Key Information:

Vendor

F5
Status
Nginx Instance Manager
Nginx Api Connectivity Manager
Nginx Security Monitoring
Vendor
CVE Published:
3 May 2023

What is CVE-2023-28724?

The NGINX Management Suite is susceptible to a vulnerability whereby default file permissions can be manipulated. Authenticated attackers may exploit this weakness to gain access to and modify sensitive files on both NGINX Instance Manager and NGINX API Connectivity Manager, potentially compromising the integrity of the system. Users of affected systems should review their file permissions and apply necessary updates or mitigations.

Affected Version(s)

NGINX API Connectivity Manager Linux 1.0.0 < 1.5.0

NGINX Instance Manager Linux 2.0.0 < 2.9.0

NGINX Instance Manager Linux 1.0.0

References

https://my.f5.com/manage/s/article/K000133233
vendor-advisory
https://security.netapp.com/advisory/ntap-20230609-0006/

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
.