NGINX API Connectivity Manager vulnerabilities

2 known vulnerabilities in NGINX API Connectivity Manager from F5. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  NGINX Instance Manager: Incorrect Default Permissions

  CVE-2023-28724May 3, 2023F5

  NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Support

• 8.1 High severity

  NGINX Instance Manager: Authorization Bypass Through User-Controlled Key

  CVE-2023-28656May 3, 2023F5

  NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.