7.1
CVE-2023-28724
- EPSS 0.08%
- Published 03.05.2023 15:15:13
- Last modified 10.04.2025 20:32:16
- Source f5sirt@f5.com
- Teams watchlist Login
- Open Login
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Data is provided by the National Vulnerability Database (NVD)
F5 ≫ Nginx Api Connectivity Manager Version >= 1.0.0 < 1.5.0
F5 ≫ Nginx Instance Manager Version >= 2.0.0 < 2.9.0
F5 ≫ Nginx Security Monitoring Version >= 1.0.0 < 1.3.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.233 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.1 | 1.8 | 5.2 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
| f5sirt@f5.com | 7.1 | 1.8 | 5.2 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
CWE-276 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.