CVE-2020-5909

Published: Jul 2, 2020Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.

Affected (3)

Products: F5: Nginx Controller

1 product

Nginx Controller

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx Controller	From 2.0.0 to 2.9.0
F5 Nginx Controller	From 3.0.0 to 3.5.0
F5 Nginx Controller	Version 1.0.1

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://support.f5.com/csp/article/K31150658

Source: f5sirt@f5.com

Vendor Advisory

https://support.f5.com/csp/article/K31150658

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.