CVE-2024-23828
Published Jan 29, 2024
Last updated 9 months ago
Overview
- Description
- Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Weaknesses
- security-advisories@github.com
- CWE-74
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4426F94-540E-497C-AE75-04126AF12112",
"versionEndExcluding": "2.0.0"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C287A7F-66B4-406A-B87B-B954A1CA6D44"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D684FFEF-4451-49ED-A04D-CF74F45A2F40"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5984B3A-40C9-4188-976C-E9EB166FA624"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EDE74B22-31D1-41D1-A5DD-DB4AAA7A7984"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25DD91AC-465B-4A43-A79F-4DE47243741C"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "115588C7-D947-4576-9E6C-B5AF1FCE9A29"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BBB20EA3-F3CF-42AF-A217-D5DF7A7ADD70"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81A6C732-FBF2-44A8-B810-456E54B59A09"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C5664E5-150E-4B4B-BA0C-420738820FF1"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E764AA1-3060-441F-8F14-ADD165316741"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04A3E84F-91AA-420A-B908-3393E037AC44"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "828EAE87-24E5-4F31-B301-BA2F96BDEA42"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45710D36-954A-4450-B622-CB0F368DF544"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B57EEFB-5518-4BD5-998A-34B6690A6F4C"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EDF4CEE-F24D-441B-92A8-7F5A2B41487E"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F0275FDF-BAE8-4909-8991-6FCE34B8905E"
},
{
"criteria": "cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B52F973F-A2F2-40C2-9936-9447B5803CFB"
}
],
"operator": "OR"
}
]
}
]