CVE-2022-23008

https://notcve.org/view.php?id=CVE-2022-23008

On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. En NGINX Controller API Management versiones 3.18.0-3.19.0, un atacante autenticado con acceso al rol "user" o "admin" puede usar endpoints de API no revelados en NGINX Controller API Management para inyectar código JavaScript que es ejecutado en instancias de plano de datos NGINX administradas. Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no son evaluadas • https://support.f5.com/csp/article/K57735782 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •