Description
NGINX Plus is a software load balancer, web server, and content cache built on top of open source NGINX. NGINX Plus has exclusive enterprise grade features beyond what's available in the open source offering, including session persistence, configuration via API, and active health checks.
NGINX+ contains a ngx_http_upstream_conf_module module. The ngx_http_upstream_conf_module module allows configuring upstream server groups on-the-fly via a simple HTTP interface without the need of restarting NGINX+. Acunetix determined that it was possible to access this HTTP interface without authentication.
It's recommended to restrict access to the NGINX+ Upstream HTTP interface as it may be used to make changes to your NGINX+ configuration.
Remediation
Restrict access to the NGINX+ Upstream HTTP interface.
References
Related Vulnerabilities
Adminer 4.6.2 file disclosure vulnerability
WordPress Plugin File Manager Information Disclosure (6.4)
WordPress Plugin Advanced File Manager Information Disclosure (5.2.4)
WordPress Plugin TRADIES Information Disclosure (2.2.6)
WordPress Plugin Child Theme Configurator Arbitrary File Disclosure (1.7.4)