Security Advisory
CVE-2020-5899
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
In NGINX Controller 3.0.0-3.4.0, recovery code required to change a users password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.