← Back

CVE-2024-23828

nvd nist
Published: Jan 29, 2024Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.

Affected (18)

Products: Nginxui: Nginx Ui
Nginxui
1 product
Nginx Ui
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Nginxui
Nginx Ui
Before 2.0.0
Nginx Ui
Version 2.0.0 beta10
Nginx Ui
Version 2.0.0 beta10_patch
Nginx Ui
Version 2.0.0 beta11
Nginx Ui
Version 2.0.0 beta1
Nginx Ui
Version 2.0.0 beta2
Nginx Ui
Version 2.0.0 beta3
Nginx Ui
Version 2.0.0 beta4
Nginx Ui
Version 2.0.0 beta4_patch
Nginx Ui
Version 2.0.0 beta5
Nginx Ui
Version 2.0.0 beta5_patch
Nginx Ui
Version 2.0.0 beta6
Nginx Ui
Version 2.0.0 beta6_patch2
Nginx Ui
Version 2.0.0 beta6_patch
Nginx Ui
Version 2.0.0 beta7
Nginx Ui
Version 2.0.0 beta8
Nginx Ui
Version 2.0.0 beta8_patch
Nginx Ui
Version 2.0.0 beta9

Related CWEs

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (2)

Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.