요약
- CVE-2024-23828은(는) github.com/0xJacky/Nginx-UI, nginx ui (nginxui)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.1%, 전체 취약점의 64.4%보다 높음.
- 조치: 1.9.10-0.20240126104956-d70e37c8575e, 2.0.0 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| github.com/0xJacky/Nginx-UI Go | < 1.9.10-0.20240126104956-d70e37c8575eall versions
| 1.9.10-0.20240126104956-d70e37c8575e
|
| nginx ui | = 2.0.0< 2.0.0
| 2.0.0
|
Description
Summary
Fix bypass to the following bugs
Allowing to inject directly in the app.ini via CRLF to change the value of test_config_cmd and start_cmd resulting in an Authenticated RCE
Impact
Authenticated Remote execution on the host
NVD description
Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.
github.com/0xJacky/Nginx-UI의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free