CVE-2024-49367 - Nginx UI's log path can be controlled

Back Back to CVE browser

MEDIUM

Nginx UI's log path can be controlled

Published Oct 21, 2024

5.5

MEDIUM

CVSS 4.0

EPSS 0.64%

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.

Affected products

Vendor 0xJacky Product Nginx-UI Default
n/a
- Version
  < 2.0.0-beta.36
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

0xJacky

Nginx-UI

n/a

Version	Status	Constraints
< 2.0.0-beta.36	affected	-

Vendor Nginxui Product Nginx UI Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <2.0.0-beta.36

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nginxui

Nginx UI

n/a

Version	Status	Constraints
0	affected	<2.0.0-beta.36

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36
x_refsource_MISCRelease Notes
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gr34-jgw4-7j4m
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36		x_refsource_MISCRelease Notes
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gr34-jgw4-7j4m		x_refsource_CONFIRMVendor Advisory