Description
The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The config_dirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow an attacker to cross a security boundary. Impact: A remotely authenticated low-privileged attacker could gain limited read and write access outside of the list of directories specified in the NGINX Agent configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
F5 NGINX Agent
Default version status: unknown
3.0.0 to < *unaffected2.0.0 to < 2.47.0affected
F5 NGINX Instance Manager
Default version status: unknown
2.22.0 to < 2.22.2affected2.17.1 to < *affected