ANCHORE-2024-49368

ANCHORE-2024-49368 PUBLISHED

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

Affected Products

Vendor	Product	Versions
0xJacky	nginx-ui	0, 0, 0

Timeline

Oct 21, 2024 CVE Published

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm url
https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36 fix

Open in Interactive Console →