A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
1.18.0-6ubuntu14.81.24.0-2ubuntu7.61.28.0-6ubuntu1.11.28.1-3ubuntu11.4.6-1ubuntu3.9+esm61.10.3-0ubuntu0.16.04.5+esm71.14.0-0ubuntu1.11+esm21.18.0-0ubuntu1.7+esm1Exploitability
AV:NAC:LAT:PPR:NUI:NVulnerable System
VC:NVI:HVA:NSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N