CVE-2024-49368

critical-risk

Published 2024-10-21

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

Do I need to act?

57.7% chance of exploitation in next 30 days

EPSS score — higher than 42% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (20)

Nginx Ui

Affected Vendors

Nginxui

References (2)

Release Notes https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36

Exploit https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm

/ 100

critical-risk

Severity 32/34 · Critical

Exploitability 18/34 · Moderate

Exposure 25/34 · High