CVE-2020-5864 Weak cryptography in NGINX Controller

What is CVE-2020-5864?

CVE-2020-5864 is a high-severity vulnerability in NGINX Controller, published on 23 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.

Weakness: CWE-295

Which versions are affected by CVE-2020-5864?

It affects 1 product.

Products include F5 Nginx Controller.

How do I fix CVE-2020-5864?

No fix has been published for CVE-2020-5864 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5864 being exploited?

There is no known exploitation of CVE-2020-5864 in the wild and no public exploit code.

Other vulnerabilities in NGINX Controller

• CVE-2020-27730 Path traversal in NGINX Controller Critical 9.8
• CVE-2020-5901 Cross-site scripting in NGINX Controller Critical 9.6
• CVE-2020-5900 Cross-site request forgery in NGINX Controller High 8.8
• CVE-2020-5863 Missing authorization in NGINX Controller High 8.6
• CVE-2020-5894 Security feature bypass in NGINX Controller High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gr6m-w52c-x634.