Paper/Archive/CVE-2020-5901

CVE-2020-5901

f5 — In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack.

EPSS 1%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 73.7.737 × 2014.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.

Affected

ProductAffectedFixed inSource

NGINX Controller3.3.0-3.4.0–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

refsupport.f5.com/csp/article/K43520321