Vulnerabilities > CVE-2024-22196 - Unspecified vulnerability in Nginxui Nginx UI

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

nginxui

NVD

Published: 2024-01-11

Updated: 2024-11-21

Summary

Nginx-UI is an online statistics for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

Vulnerable Configurations

Part	Description	Count
Application	Nginxui Nginxui Nginx UI 1.2.0 Nginxui Nginx UI 1.2.1 Nginxui Nginx UI 1.2.2 Nginxui Nginx UI 1.3.0 Nginxui Nginx UI 1.3.1 Nginxui Nginx UI 1.3.2 Nginxui Nginx UI 1.3.3 Nginxui Nginx UI 1.4.0 Nginxui Nginx UI 1.4.1 Nginxui Nginx UI 1.4.2 Nginxui Nginx UI 1.5.0 Nginxui Nginx UI 1.5.1 Nginxui Nginx UI 1.5.2 Nginxui Nginx UI 1.6.0 Nginxui Nginx UI 1.6.1 Nginxui Nginx UI 1.6.2 Nginxui Nginx UI 1.6.3 Nginxui Nginx UI 1.6.5 Nginxui Nginx UI 1.6.6 Nginxui Nginx UI 1.6.7 Nginxui Nginx UI 1.6.8 Nginxui Nginx UI 1.7.0 Nginxui Nginx UI 1.7.1 Nginxui Nginx UI 1.7.2 Nginxui Nginx UI 1.7.3 Nginxui Nginx UI 1.7.4 Nginxui Nginx UI 1.7.5 Nginxui Nginx UI 1.7.6 Nginxui Nginx UI 1.7.7 Nginxui Nginx UI 1.7.8 Nginxui Nginx UI 1.7.9 Nginxui Nginx UI 1.8.0 Nginxui Nginx UI 1.8.1 Nginxui Nginx UI 1.8.2 Nginxui Nginx UI 1.8.3 Nginxui Nginx UI 1.8.4 Nginxui Nginx UI 1.9.9 Nginxui Nginx UI 1.9.9-1 Nginxui Nginx UI 1.9.9-2 Nginxui Nginx UI 1.9.9-3 Nginxui Nginx UI 1.9.9-4 Nginxui Nginx UI 2.0.0	76

Summary

Vulnerable Configurations

References