Sign-up

ID

VAR-202106-1414


CVE

CVE-2021-23019


TITLE

NGINX Controller  Vulnerability regarding inadequate protection of credentials in

Trust: 0.8

sources: JVNDB: JVNDB-2021-007661

DESCRIPTION

The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package. NGINX Controller Exists in an inadequate protection of credentials.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5 Corporation in the United States. The platform supports managing multiple NGINX instances using a visual interface. The following products and versions are affected: NGINX Controller: 2.0.0, charm, 2.2.0, tripwire, testbox, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.8.1 releases, 2.9. 0,3.0.0,3.1.0,3.2.0,3.3.0,3.4.0,3.5.0,3.6.0,3.7.0,3.8.0,3.9.0,3.10.0,3.12.0, 3.12.1, 3.13.0 3.14.0

Trust: 2.34

sources: NVD: CVE-2021-23019 // JVNDB: JVNDB-2021-007661 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-381505 // VULMON: CVE-2021-23019

AFFECTED PRODUCTS

vendor:f5model:nginx controllerscope:gteversion:3.0.0

Trust: 1.0

vendor:f5model:nginx controllerscope:lteversion:2.9.0

Trust: 1.0

vendor:f5model:nginx controllerscope:gteversion:2.0.0

Trust: 1.0

vendor:f5model:nginx controllerscope:ltversion:3.15.0

Trust: 1.0

vendor:f5model:nginx controllerscope:eqversion:3.15.0

Trust: 0.8

vendor:f5model:nginx controllerscope:eqversion:2.0.0 to 2.9.0

Trust: 0.8

vendor:f5model:nginx controllerscope:eqversion: -

Trust: 0.8

vendor:f5model:nginx controllerscope:ltversion:3.x

Trust: 0.8

sources: JVNDB: JVNDB-2021-007661 // NVD: CVE-2021-23019

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-23019
value: HIGH

Trust: 1.0

NVD: CVE-2021-23019
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202105-1580
value: HIGH

Trust: 0.6

VULHUB: VHN-381505
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-23019
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-23019
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-381505
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-23019
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-23019
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-381505 // VULMON: CVE-2021-23019 // JVNDB: JVNDB-2021-007661 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1580 // NVD: CVE-2021-23019

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.1

problemtype:CWE-201

Trust: 1.0

problemtype:Inadequate protection of credentials (CWE-522) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-381505 // JVNDB: JVNDB-2021-007661 // NVD: CVE-2021-23019

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202105-1580

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1580

PATCH

title:K04884013url:https://support.f5.com/csp/article/K04884013

Trust: 0.8

title:Nginx Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=152566

Trust: 0.6

sources: JVNDB: JVNDB-2021-007661 // CNNVD: CNNVD-202105-1580

EXTERNAL IDS

db:NVDid:CVE-2021-23019

Trust: 3.4

db:JVNDBid:JVNDB-2021-007661

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021052545

Trust: 0.6

db:AUSCERTid:ESB-2021.1802

Trust: 0.6

db:CNNVDid:CNNVD-202105-1580

Trust: 0.6

db:VULHUBid:VHN-381505

Trust: 0.1

db:VULMONid:CVE-2021-23019

Trust: 0.1

sources: VULHUB: VHN-381505 // VULMON: CVE-2021-23019 // JVNDB: JVNDB-2021-007661 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1580 // NVD: CVE-2021-23019

REFERENCES

url:https://support.f5.com/csp/article/k04884013

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-23019

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021052545

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1802

Trust: 0.6

url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-f5-nginx-controller-affect-ibm-cloud-pak-for-automation/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/522.html

Trust: 0.1

url:https://github.com/live-hack-cve/cve-2021-23019

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-381505 // VULMON: CVE-2021-23019 // JVNDB: JVNDB-2021-007661 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202105-1580 // NVD: CVE-2021-23019

SOURCES

db:VULHUBid:VHN-381505
db:VULMONid:CVE-2021-23019
db:JVNDBid:JVNDB-2021-007661
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202105-1580
db:NVDid:CVE-2021-23019

LAST UPDATE DATE

2024-08-14T12:17:35.618000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-381505date:2022-08-30T00:00:00
db:VULMONid:CVE-2021-23019date:2022-08-30T00:00:00
db:JVNDBid:JVNDB-2021-007661date:2022-02-18T09:04:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202105-1580date:2022-08-31T00:00:00
db:NVDid:CVE-2021-23019date:2022-08-30T22:42:20.447

SOURCES RELEASE DATE

db:VULHUBid:VHN-381505date:2021-06-01T00:00:00
db:VULMONid:CVE-2021-23019date:2021-06-01T00:00:00
db:JVNDBid:JVNDB-2021-007661date:2022-02-18T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202105-1580date:2021-05-25T00:00:00
db:NVDid:CVE-2021-23019date:2021-06-01T13:15:07.907