CVE-2020-5901
CRITICALF5 NGINX Controller 3.3.0-3.4.0 - Reflected Cross-Site Scripting via Undisclosed API Endpoints
Title source: llmDescription
In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://support.f5.com/csp/article/K43520321
Scores
CVSS v3
9.6
EPSS
0.0088
EPSS Percentile
75.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-79
Status
published
Products (1)
f5/nginx_controller
3.3.0 - 3.4.0
Published
Jul 01, 2020
Tracked Since
Feb 18, 2026