7.1
CVE-2023-28724
- EPSS 0.08%
- Veröffentlicht 03.05.2023 15:15:13
- Zuletzt bearbeitet 10.04.2025 20:32:16
- Quelle f5sirt@f5.com
- Teams Watchlist Login
- Unerledigt Login
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
F5 ≫ Nginx Api Connectivity Manager Version >= 1.0.0 < 1.5.0
F5 ≫ Nginx Instance Manager Version >= 2.0.0 < 2.9.0
F5 ≫ Nginx Security Monitoring Version >= 1.0.0 < 1.3.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.233 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.1 | 1.8 | 5.2 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
| f5sirt@f5.com | 7.1 | 1.8 | 5.2 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
CWE-276 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.