Vulnerability Details : CVE-2023-1550
Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note: NGINX Agent is included with NGINX Instance Manager and used in conjunction with NGINX API Connectivity Manager, and NGINX Management Suite Security Monitoring.
Products affected by CVE-2023-1550
- cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:f5:nginx_agent:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-1550
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-1550
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
F5 Networks |
CWE ids for CVE-2023-1550
-
The product writes sensitive information to a log file.Assigned by: f5sirt@f5.com (Primary)
References for CVE-2023-1550
-
https://security.netapp.com/advisory/ntap-20230511-0008/
CVE-2023-1550 NGINX Vulnerability in NetApp Products | NetApp Product Security
-
https://my.f5.com/manage/s/article/K000133135
NGINX Agent vulnerability CVE-2023-1550Vendor Advisory
Jump to