Vulnerability Details CVE-2020-5895
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 19.7%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 4.6
References
Products affected by CVE-2020-5895
-
cpe:2.3:a:f5:nginx_controller:3.1.0
-
cpe:2.3:a:f5:nginx_controller:3.2.0
-
cpe:2.3:a:f5:nginx_controller:3.3.0