Vulnerability · Published Aug 4, 2022 · Assigned by f5
CVE-2022-35241NGINX Instance Manager vulnerability CVE-2022-35241
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in NGINX Instance Manager from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Instance Manager | 2.x – before 2.3.11.0.0 – before 1.x* |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://support.f5.com/csp/article/K37080719 x_refsource_MISC