Read the docs
TI-2020-04785 Aliases CVE-2020-5867GHSA-mrgg-hv86-p2g9

Cleartext transmission of sensitive information in NGINX Controller

Priority LOW 36CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319 and CWE-494.

Summary

In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages

Why it matters now

EPSS 0.00476 41st percentileScored 2026-11-07
Fix Fixed NGINX Controller: 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—NGINX Controllerbefore 3.3.03.3.0Patch availableCNA
  • NGINX Controller Vendor— Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_controller:*:*:*:*:*:*:*:*2.0.0 – 2.9.0; 3.0.0 to before 3.3.0VulnerableF5
cpe:2.3:a:f5:nginx_controller:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableF5
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:f5:nginx_controller:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.9.0; 3.0.0 to before 3.3.0 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_controller:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·F5
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA NGINX Controller Fixed in 3.3.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5867
  2. 2026-10-03 Alias added: GHSA-mrgg-hv86-p2g9

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences