K57735782 : NGINX Controller API Management vulnerability CVE-2022-23008

Security Advisory Description

An authenticated attacker with access to the “user” or “admin” role can use undisclosed API endpoints on NGINX Controller API Management to inject JavaScript code that is executed on managed NGINX data plane instances. (CVE-2022-23008)

Impact

Successful exploitation allows an attacker to read and/or write files on the NGINX data plane instance. The access to files is limited to the user running the NGINX process, typically the nginx user.