CVE-2020-5894 - On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out

HIGH

On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out

Published May 7, 2020

8.1

HIGH

CVSS 3.1

EPSS 1.02%

On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	NGINX Controller	unknown	Affected < 3.4.0

No remediation recorded yet.

Weaknesses (1)

CWE-384

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27048		Advisory
https://support.f5.com/csp/article/K13028514		x_refsource_MISCMitigationVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner f5

Published May 7, 2020

Updated Aug 4, 2024

Reserved Jan 6, 2020

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner f5

Published May 7, 2020

Updated Aug 4, 2024

GitHub

No data