CVE-2022-23008CWE-94

On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API…

published January 25, 2022

CVSS
—
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-01-25T19:11Z
EPSS history
Timeline
  • 25 JAN 19:11Z
    On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undisclosed API…
    cvelistv5