CVE-2020-5899
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
En NGINX Controller versiones 3.0.0 hasta 3.4.0, el código de recuperación requerido para cambiar la contraseña de un usuario es transmitida y almacenada en la base de datos en texto plano, lo que permite a un atacante, que pueda interceptar la conexión de la base de datos o tener acceso de lectura a la base de datos, solicitar restablecer la contraseña usando la dirección de correo electrónico de otro usuario registrado y entonces recobrar el código de recuperación
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-06 CVE Reserved
- 2020-07-01 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-312: Cleartext Storage of Sensitive Information
- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-522: Insufficiently Protected Credentials
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://support.f5.com/csp/article/K25434422 | 2021-07-21 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
F5 Search vendor "F5" | Nginx Controller Search vendor "F5" for product "Nginx Controller" | >= 3.0.0 <= 3.4.0 Search vendor "F5" for product "Nginx Controller" and version " >= 3.0.0 <= 3.4.0" | - |
Affected
|