High severity7.1NVD Advisory· Published May 3, 2023· Updated Jun 17, 2026

CVE-2023-28724

Description

NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Nginx/NGINX Management Suitellm-create
F5, Inc./Nginx API Connectivity Managerv5
Range: 1.0.0
F5, Inc./Nginx Instance Managerv5
Range: 2.0.0
F5, Inc./Nginx Security Monitoringv5
Range: 1.0.0

Patches

Vulnerability mechanics

References

my.f5.com/manage/s/article/K000133233nvdVendor Advisory
security.netapp.com/advisory/ntap-20230609-0006/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.461
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000