CVE-2024-23827

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-23827
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-23827.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-23827
Aliases
Related
Published
2024-01-29T16:15:09Z
Modified
2025-01-08T09:50:21.541344Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.

References

Affected packages

Git / github.com/0xjacky/nginx-ui

Affected ranges

Type
GIT
Repo
https://github.com/0xjacky/nginx-ui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
02fb07f6b4885c599e84077078e095a1007dae61
Last affected
0c0594a7ee218f50f25c11da16647fe019f6a3e4
Last affected
0fe9bf56d6673a801e9ae18221616be0c0a7f500
Last affected
133a0e9501c0a3a0e17727efffeafc23be0b60f9
Last affected
1803f1308f6b6e60390717ae1efdd59acdf1be2d
Last affected
1aa4e70c555942a80e22fcadb11f4d1922ee602e
Last affected
1bc8d0a4a94054a901b713458f86ef0b8282e905
Last affected
1dc5f716885ae8e0d45588431fa30bce04de7e1e
Last affected
26938ae1bbdecbf76015f2e7747940b1577aeb16
Last affected
2d4c15e7f9777504b26e0a82893d7e07a1f83523
Last affected
33064693a693dfbe5690eafe620a0e343c430526
Last affected
33481774702bac98a1beb2c8a5d05db78f7b57c0
Last affected
34fc0a23cab89c9521cd7bb4436cb6631cc3d031
Last affected
394bd0e578388d7a42c19572ab958d388a484f7f
Last affected
3b632252fbc754e6d64512710310b46946b0b282
Last affected
3c56bf19ca258499c77905a8a063041b3cf344cd
Last affected
3fef0cf2ac35b1ee396305e774ae934df35ea553
Last affected
41ced2ea05f188de573b8b39299db5b92e2f9449
Last affected
4bce9025af36d89f6808e81dda9247b225fe838e
Last affected
4c722b9e64691f20112d34e8b255d654e7d9a3ef
Last affected
561771cf10bfd9fa8ec680855daca43031d36bf6
Last affected
5b34f0f052773ca5c6da47d4b56d5c467ac06c6c
Last affected
5d0407ed0727a5d986a427a8f6781ffe78eba17c
Last affected
6c74ad4a01dc3766997b633c96aafdb27a422b1f
Last affected
6dce44a3ccad814deb650f7f744c21f2df9cbd71
Last affected
705d71d3b7f79c9f9ecb9e63a6d212fe791c6d2e
Last affected
70e3f2d3729c53f259c566774adee7f87b6b0126
Last affected
74a48d34620f5a9ee3001a2062b5eaa598b056af
Last affected
7849ef76bcb6a73f041addae4125650233237c6b
Last affected
83883c1ab9bffa7ca15427ca041ee7ad6f07e5db
Last affected
8b60d61b8e54db17590e30b2f21ae6759c9fa89a
Last affected
8c3e4819c04a6d1955d4f3935abb32818f327592
Last affected
909f7380b661d150382fec5e221aeca45c0a44f2
Last affected
92fb679b550c03f64394160e1bf5fb4377459862
Last affected
9ac5708ecad97bdbcb71bc3c784203e3a35aaf21
Last affected
a43b99feb9bd3d830a727ba0c16fb99259d52284
Last affected
a571bccb84718c5c2794b2295ba67e25590d5653
Last affected
a5b23d569c0a0310d0cdc5992bcca0299999a80b
Last affected
b3cf13ad504ca55293689aa629f202b533eb762b
Last affected
b5f20c62bc501446cbbe926ee719884a15da8cb4
Last affected
c16ea53ed119e1cc6e7798a72cd8058f6dff2f41
Last affected
c4f87fb4cc49344aec657ff6b3c1ab49a940d170
Last affected
c5a59eed948f957bce7f3ae92bc3f6ce96acf8bd
Last affected
ca3c9946ce8504f08ba2888c6e4dbbfefeff52ff
Last affected
cab5ff2c780b41fdaee7941faea03df1ca0351f6
Last affected
cba0028c4fb9ad170802f7260675eb538707c783
Last affected
d6a5bfc46a7f0ee285bd1a2e144befcfa1532317
Last affected
d7ce452b8b4c243eda42b53bf6785ef332dce6b7
Last affected
e28e46db320c233699aea56c4061a29c0baff9c3
Last affected
eab95dd09100b7d771e2b6970174fb5706a672ed
Last affected
eac9669f0a492b1dc2947944a0f7ea1f3e9254e8
Last affected
f455cf13b8138248bc6bb4ccb6c08c2d43d652cd

Affected versions

v1.*

v1.1.0
v1.2.0
v1.2.0-alpha.3
v1.2.0-alpha.4
v1.2.0-rc.1
v1.2.0-rc.2
v1.2.0-rc.3
v1.2.1
v1.2.2
v1.3.0
v1.3.0-rc1
v1.3.1
v1.3.1-fix
v1.3.2
v1.3.3-rc1
v1.4.0
v1.4.0-rc1
v1.4.1
v1.4.2
v1.5.0
v1.5.0-beta1
v1.5.0-beta2
v1.5.0-beta3
v1.5.0-beta4
v1.5.0-beta4-fix
v1.5.0-beta5
v1.5.0-beta6
v1.5.0-beta7
v1.5.0-beta8
v1.5.0-beta9
v1.5.1
v1.5.2
v1.6.0
v1.6.0-fix
v1.6.1
v1.6.2
v1.6.3
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.7.0
v1.7.0-patch
v1.7.1
v1.7.2