CVE-2020-5899
N/A
N/A
Summary
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | NGINX Controller | 3.0.0-3.4.0 | affected |
Weaknesses
- account hijacking
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.