CVE-2020-5895 - On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket

Back Back to CVE browser

HIGH

On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket

Published May 7, 2020

7.8

HIGH

CVSS 3.1

EPSS 0.30%

Description

On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.

Affected products

Vendor n/a Product NGINX Controller Default
n/a
- Version
  < 3.4.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

NGINX Controller

n/a

Version	Status	Constraints
< 3.4.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27049
Advisory
https://security.netapp.com/advisory/ntap-20200522-0001/
x_refsource_CONFIRM
https://support.f5.com/csp/article/K95120415
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-27049		Advisory
https://security.netapp.com/advisory/ntap-20200522-0001/		x_refsource_CONFIRM
https://support.f5.com/csp/article/K95120415		x_refsource_MISCVendor Advisory