CVE-2023-28724 NGINX Management Suite vulnerability
An authenticated attacker can modify sensitive files due to insecure default file permissions in NGINX Management Suite components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28724?
CVE-2023-28724 is a high-severity vulnerability in F5 NGINX API Connectivity Manager, published on 3 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-276
Which versions are affected by CVE-2023-28724?
It affects 3 products.
Products include F5 Nginx Api Connectivity Manager, F5 Nginx Instance Manager, F5 Nginx Security Monitoring.
How do I fix CVE-2023-28724?
No fix has been published for CVE-2023-28724 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-28724 being exploited?
There is no known exploitation of CVE-2023-28724 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX API Connectivity Manager
Sources
Also known as GHSA-9mcp-v29j-j4hp.