WID-SEC-2023-1144 — NGINX: Mehrere Schwachstellen

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in NGINX ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder Informationen offenzulegen.

Product

NGINX ist eine Webserver-, Reverse Proxy- und E-Mail-Proxy Software.

Vulnerabilities 2

High 8.1

CVE-2023-28656

NGINX Management Suite vulnerability

NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

F5 NGINX Instance Manager NGINX API Connectivity Manager NGINX Security Monitoring Network devices

May 3, 2023
High 7.1

CVE-2023-28724

NGINX Management Suite vulnerability

NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Suppo…

F5 NGINX Instance Manager NGINX API Connectivity Manager NGINX Security Monitoring Network devices

May 3, 2023

Revision history

2023-05-03 #1
Initiale Fassung

References

F5 Security Advisory vom 2023-05-03
https://my.f5.com/manage/s/article/K000133417
F5 Security Advisory vom 2023-05-03
https://my.f5.com/manage/s/article/K000133233