CVE-2021-23055

Published: Apr 21, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (2)

Products: F5: Nginx Ingress Controller

1 product

Nginx Ingress Controller

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx Ingress Controller	From 1.0.0 to 1.12.3
F5 Nginx Ingress Controller	From 2.0.0 to 2.0.3

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://support.f5.com/csp/article/K01051452

Source: f5sirt@f5.com

MitigationVendor Advisory

https://support.f5.com/csp/article/K01051452

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.