CVE-2024-49368
HIGH 1 PoC
HIGH
Priority: 2.46
BB Relevance:
93/100
Published: 2024-10-21
Modified: 2026-11-04
First seen: 2026-11-03
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
AT:
None
VC:
High
VI:
High
VA:
High
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.
Weakness Classification (1)
Affected Software (51)
| Vendor | Product | Version |
|---|---|---|
| 0xJacky | nginx-ui | < 2.0.0-beta.36 |
| 0xJacky | nginx-ui | < 2.0.0-beta.36 |
| nginxui | nginx_ui | < 1.9.9-4 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
| nginxui | nginx_ui | 2.0.0 |
Showing 30 of 51 entries
References & Advisories (2)
x_refsource_MISC
x_refsource_CONFIRM