En resumen
- CVE-2024-23828 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a github.com/0xJacky/Nginx-UI, nginx ui (nginxui).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.1%, mayor que el 64.4% de las vulnerabilidades.
- Solución: actualizar a 1.9.10-0.20240126104956-d70e37c8575e, 2.0.0 o posterior.
| Package | Affected versions | Patched versions |
|---|
| github.com/0xJacky/Nginx-UI Go | < 1.9.10-0.20240126104956-d70e37c8575eall versions
| 1.9.10-0.20240126104956-d70e37c8575e
|
| nginx ui | = 2.0.0< 2.0.0
| 2.0.0
|
Description
Summary
Fix bypass to the following bugs
Allowing to inject directly in the app.ini via CRLF to change the value of test_config_cmd and start_cmd resulting in an Authenticated RCE
Impact
Authenticated Remote execution on the host
NVD description
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.
Más vulnerabilidades de github.com/0xJacky/Nginx-UI
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free