CVE-2020-5865 Weak cryptography in NGINX Controller

What is CVE-2020-5865?

CVE-2020-5865 is a medium-severity vulnerability in Netapp Cloud Backup, published on 23 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle (MiTM) attacks.

Weakness: CWE-319

Which versions are affected by CVE-2020-5865?

It affects 2 products.

Products include F5 Nginx Controller, Netapp Cloud Backup.

How do I fix CVE-2020-5865?

No fix has been published for CVE-2020-5865 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5865 being exploited?

There is no known exploitation of CVE-2020-5865 in the wild and no public exploit code.

Other vulnerabilities in Netapp Cloud Backup

• CVE-2020-27730 Path traversal in NGINX Controller Critical 9.8
• CVE-2020-5901 Cross-site scripting in NGINX Controller Critical 9.6
• CVE-2020-5900 Cross-site request forgery in NGINX Controller High 8.8
• CVE-2020-5863 Missing authorization in NGINX Controller High 8.6
• CVE-2020-5894 Security feature bypass in NGINX Controller High 8.1

All Netapp Cloud Backup vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-83x8-frp9-8943.