Vulnerability · Published Aug 22, 2024 · Assigned by f5
CVE-2024-7634NGINX Agent Vulnerability
Medium 4.9
In plain English
A medium-severity path traversal in NGINX Agent from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Agent | 2.17.0 – before 2.37.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
References
- https://my.f5.com/manage/s/article/K000140630 vendor-advisory