CVE-2020-27730

CRITICAL

F5 NGINX Controller 1.0.1 2.0.0-2.9.0 3.0.0-3.9.0 - Path Traversal via Relative Paths in System Utility Calls

Title source: llm
STIX 2.1

Description

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_confirm
https://support.f5.com/csp/article/K43530108
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210115-0004/

Scores

CVSS v3 9.8
EPSS 0.0146
EPSS Percentile 81.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (3)
f5/nginx_controller 1.0.1
f5/nginx_controller 2.0.0 - 2.9.0
netapp/cloud_backup
Published Dec 11, 2020
Tracked Since Feb 18, 2026