CVE-2020-5863 Missing authorization in NGINX Controller

What is CVE-2020-5863?

CVE-2020-5863 is a high-severity missing authorization vulnerability in Netapp Cloud Backup, published on 27 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.

Which versions are affected by CVE-2020-5863?

It affects 2 products.

Products include F5 Nginx Controller, Netapp Cloud Backup.

How do I fix CVE-2020-5863?

No fix has been published for CVE-2020-5863 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-5863 being exploited?

There is no known exploitation of CVE-2020-5863 in the wild and no public exploit code.

Other vulnerabilities in Netapp Cloud Backup

• CVE-2020-27730 Path traversal in NGINX Controller Critical 9.8
• CVE-2020-5901 Cross-site scripting in NGINX Controller Critical 9.6
• CVE-2020-5900 Cross-site request forgery in NGINX Controller High 8.8
• CVE-2020-5894 Security feature bypass in NGINX Controller High 8.1
• CVE-2020-5867 Supply chain in NGINX Controller High 8.1

All Netapp Cloud Backup vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-92v9-882v-4qfr.