CVE-2021-23019

Name of the Vulnerable Software and Affected Versions NGINX Controller versions 2.0.0 through 2.9.0 NGINX Controller versions 3.x before 3.15.0

Description The issue is related to insufficient protection of registration data, which may allow an attacker to disclose protected information. Specifically, the Administrator password may be exposed in the systemd.txt file included in the NGINX support package.

Recommendations For NGINX Controller versions 2.0.0 through 2.9.0, update to version 3.15.0 or later to resolve the issue. For NGINX Controller versions 3.x before 3.15.0, update to version 3.15.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the systemd.txt file to minimize the risk of exploitation.