CVE-2024-22196

Published Jan 11, 2024

Last updated 9 months ago

Overview

Description: Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.
Source: security-advisories@github.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

security-advisories@github.com: CWE-89

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B4426F94-540E-497C-AE75-04126AF12112",
            "versionEndExcluding": "2.0.0"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3C287A7F-66B4-406A-B87B-B954A1CA6D44"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "25DD91AC-465B-4A43-A79F-4DE47243741C"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "115588C7-D947-4576-9E6C-B5AF1FCE9A29"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BBB20EA3-F3CF-42AF-A217-D5DF7A7ADD70"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "81A6C732-FBF2-44A8-B810-456E54B59A09"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C5664E5-150E-4B4B-BA0C-420738820FF1"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E764AA1-3060-441F-8F14-ADD165316741"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "04A3E84F-91AA-420A-B908-3393E037AC44"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "828EAE87-24E5-4F31-B301-BA2F96BDEA42"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "45710D36-954A-4450-B622-CB0F368DF544"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B57EEFB-5518-4BD5-998A-34B6690A6F4C"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8EDF4CEE-F24D-441B-92A8-7F5A2B41487E"
          },
          {
            "criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F0275FDF-BAE8-4909-8991-6FCE34B8905E"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References