« Volver al listado

CVE-2023-28724

Estado: AnalizadaAlta (7.1)—

NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

F5 — Nginx API Connectivity ManagerF5 — Nginx Instance ManagerF5 — Nginx Security Monitoring

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-28724",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-28724",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-03T18:25:48.222409Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "f5sirt@f5.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "f5sirt@f5.com",
      "affectedData": [
        {
          "vendor": "F5",
          "product": "NGINX Instance Manager",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "lessThan": "2.9.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "*",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "F5",
          "product": "NGINX API Connectivity Manager",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.5.0",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "F5",
          "product": "NGINX Security Monitoring",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.3.0",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-05-03T15:15:13.020",
  "references": [
    {
      "url": "https://my.f5.com/manage/s/article/K000133233",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230609-0006/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "f5sirt@f5.com"
    },
    {
      "url": "https://my.f5.com/manage/s/article/K000133233",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20230609-0006/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "f5sirt@f5.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
    }
  ],
  "lastModified": "2026-06-17T05:48:38.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:f5:nginx_api_connectivity_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC45BFDB-391A-4EB6-B74E-1C80000B044F",
              "versionEndExcluding": "1.5.0",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAEC7716-B3B5-4640-A094-38379425DB83",
              "versionEndExcluding": "2.9.0",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:f5:nginx_security_monitoring:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBEBF811-2D7D-427C-805A-D430360C3FA3",
              "versionEndExcluding": "1.3.0",
              "versionStartIncluding": "1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com"
}