Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-5899

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can interc

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
f5

Description

In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a NGINX Controller

  • 3.0.0-3.4.0affected

References