CVE-2020-5866 Information disclosure in NGINX Controller

What is CVE-2020-5866?

CVE-2020-5866 is a medium-severity vulnerability in NGINX Controller, published on 23 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.

Weakness: CWE-200

Which versions are affected by CVE-2020-5866?

It affects 1 product.

Products include F5 Nginx Controller.

How do I fix CVE-2020-5866?

No fix has been published for CVE-2020-5866 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5866 being exploited?

There is no known exploitation of CVE-2020-5866 in the wild and no public exploit code.

Other vulnerabilities in NGINX Controller

• CVE-2020-27730 Path traversal in NGINX Controller Critical 9.8
• CVE-2020-5901 Cross-site scripting in NGINX Controller Critical 9.6
• CVE-2020-5900 Cross-site request forgery in NGINX Controller High 8.8
• CVE-2020-5863 Missing authorization in NGINX Controller High 8.6
• CVE-2020-5894 Security feature bypass in NGINX Controller High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-28pm-98wm-6937.