TI-2020-04784 Aliases CVE-2020-5866 GHSA-28pm-98wm-6937

Information disclosure in NGINX Controller

LOW 25CWE-200Published 2020-04-23 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

In versions of NGINX Controller prior to 3.3.0, the helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments.

Why it matters now

EPSS 0.0034 27th percentileScored 2026-11-07

Fix Fixed NGINX Controller: 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	NGINX Controller	before 3.3.0	3.3.0	Patch available	CNA

NGINX Controller Vendor— Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:nginx_controller::::::::	2.0.0 – 2.9.0; 3.0.0 to before 3.3.0	Vulnerable	F5
cpe:2.3:a:f5:nginx_controller:1.0.1:::::::*	1.0.1	Vulnerable	F5

cpe:2.3:a:f5:nginx_controller:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.9.0; 3.0.0 to before 3.3.0 Vulnerable ·F5
cpe:2.3:a:f5:nginx_controller:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·F5

Remediation

Fix · CNA NGINX Controller Fixed in 3.3.0

Timeline

2026-10-02 Threatist record created from CVE-2020-5866
2026-10-03 Alias added: GHSA-28pm-98wm-6937

References

Advisory 1

https://support.f5.com/csp/article/K11922628

Other 1

https://security.netapp.com/advisory/ntap-20200430-0005/

TI-2020-16818 Path traversal in NGINX Controller CVSS 3.1CRITICAL 9.8
TI-2020-04819 Cross-site scripting in NGINX Controller CVSS 3.1CRITICAL 9.6
TI-2020-04781 In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network… CVSS 3.1HIGH 8.6
TI-2020-04818 Cross-site request forgery in NGINX Controller CVSS 3.1HIGH 8.8
TI-2020-04812 Session fixation in NGINX Controller CVSS 3.1HIGH 8.1
TI-2020-04785 Cleartext transmission of sensitive information in NGINX Controller CVSS 3.1HIGH 8.1

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences