What’s Vulnerable › Vulnerabilities

CVE-2020-5863

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-27 · updated 2026-06-17

Description

In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.

Affected products

• NGINX Controller: from 2.0.0 through 2.9.0; from 3.0.0 before 3.2.0; 1.0.1 — fixed in 3.2.0
• NetApp Cloud Backup: all versions

How to fix

Upgrade to a fixed version: NGINX Controller 3.2.0. Check the vendor advisory for mitigations.

References

• https://security.netapp.com/advisory/ntap-20200430-0005/
• https://support.f5.com/csp/article/K14631834
• https://security.netapp.com/advisory/ntap-20200430-0005/
• https://support.f5.com/csp/article/K14631834

Get alerted when CVE-2020-5863 or the next vulnerability affects your stack