Vulnerability Details CVE-2020-5910
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 57.1%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2020-5910
-
cpe:2.3:a:f5:nginx_controller:1.0.1
-
cpe:2.3:a:f5:nginx_controller:2.0.0
-
cpe:2.3:a:f5:nginx_controller:2.1.0
-
cpe:2.3:a:f5:nginx_controller:2.2.0
-
cpe:2.3:a:f5:nginx_controller:2.3.0
-
cpe:2.3:a:f5:nginx_controller:2.4.0
-
cpe:2.3:a:f5:nginx_controller:2.5.0
-
cpe:2.3:a:f5:nginx_controller:2.6.0
-
cpe:2.3:a:f5:nginx_controller:2.7.0
-
cpe:2.3:a:f5:nginx_controller:2.8.0
-
cpe:2.3:a:f5:nginx_controller:2.8.1
-
cpe:2.3:a:f5:nginx_controller:2.9.0
-
cpe:2.3:a:f5:nginx_controller:3.0.0
-
cpe:2.3:a:f5:nginx_controller:3.1.0
-
cpe:2.3:a:f5:nginx_controller:3.2.0
-
cpe:2.3:a:f5:nginx_controller:3.3.0
-
cpe:2.3:a:f5:nginx_controller:3.4.0
-
cpe:2.3:a:f5:nginx_controller:3.5.0