CVE-2024-22197

CVSS 3.1 Score 8.8 of 10 (high)

Attack Complexity low
Confidentiality high
Integrity high
Availability high
Privileges Required low
Scope unchanged

Details

Published Jan 11, 2024
Updated: Feb 29, 2024
CWE ID 77

Summary

CVE-2024-22197 is a vulnerability affecting Nginx-ui, an online statistics tool used for monitoring Server Indicators. Although the UI restricts users from modifying certain nginx settings, the API exposes three commands: `test_config_cmd`, `reload_cmd`, and `restart_cmd`. While these functions are not accessible through the UI, a malicious user can execute them by making an API request. This issue poses risks of Authentication Bypass leading to Remote Code Execution, Privilege Escalation, and Information Disclosure. The vulnerability has been addressed in version 2.0.0.beta.9.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share