In NGINX Controller 3.0.0-3.4.0, recovery code required to change a users password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nginx_controller | F5 | 3.0.0 (including) | 3.4.0 (including) |