CVE-2024-22196

Published: Jan 11, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

Affected (14)

Products: Nginxui: Nginx Ui

Nginxui

1 product

Nginx Ui

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Nginxui Nginx Ui	Before 2.0.0
Nginxui Nginx Ui	Version 2.0.0 beta1
Nginxui Nginx Ui	Version 2.0.0 beta2
Nginxui Nginx Ui	Version 2.0.0 beta3
Nginxui Nginx Ui	Version 2.0.0 beta4
Nginxui Nginx Ui	Version 2.0.0 beta4_patch
Nginxui Nginx Ui	Version 2.0.0 beta5
Nginxui Nginx Ui	Version 2.0.0 beta5_patch
Nginxui Nginx Ui	Version 2.0.0 beta6
Nginxui Nginx Ui	Version 2.0.0 beta6_patch2
Nginxui Nginx Ui	Version 2.0.0 beta6_patch
Nginxui Nginx Ui	Version 2.0.0 beta7
Nginxui Nginx Ui	Version 2.0.0 beta8
Nginxui Nginx Ui	Version 2.0.0 beta8_patch