Vulnerabilities > CVE-2024-49367 - Missing Authorization vulnerability in Nginxui Nginx UI

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

nginxui

CWE-862

NVD

Published: 2024-10-21

Updated: 2024-11-07

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.

Vulnerable Configurations

Part	Description	Count
Application	Nginxui Nginxui Nginx UI 2.0.0 Nginxui Nginx UI 1.2.0 Nginxui Nginx UI 1.2.1 Nginxui Nginx UI 1.2.2 Nginxui Nginx UI 1.3.0 Nginxui Nginx UI 1.3.1 Nginxui Nginx UI 1.3.2 Nginxui Nginx UI 1.3.3 Nginxui Nginx UI 1.4.0 Nginxui Nginx UI 1.4.1 Nginxui Nginx UI 1.4.2 Nginxui Nginx UI 1.5.0 Nginxui Nginx UI 1.5.1 Nginxui Nginx UI 1.5.2 Nginxui Nginx UI 1.6.0 Nginxui Nginx UI 1.6.1 Nginxui Nginx UI 1.6.2 Nginxui Nginx UI 1.6.3 Nginxui Nginx UI 1.6.5 Nginxui Nginx UI 1.6.6 Nginxui Nginx UI 1.6.7 Nginxui Nginx UI 1.6.8 Nginxui Nginx UI 1.7.0 Nginxui Nginx UI 1.7.1 Nginxui Nginx UI 1.7.2 Nginxui Nginx UI 1.7.3 Nginxui Nginx UI 1.7.4 Nginxui Nginx UI 1.7.5 Nginxui Nginx UI 1.7.6 Nginxui Nginx UI 1.7.7 Nginxui Nginx UI 1.7.8 Nginxui Nginx UI 1.7.9 Nginxui Nginx UI 1.8.0 Nginxui Nginx UI 1.8.1 Nginxui Nginx UI 1.8.2 Nginxui Nginx UI 1.8.3 Nginxui Nginx UI 1.8.4 Nginxui Nginx UI 1.9.9 Nginxui Nginx UI 1.9.9-1 Nginxui Nginx UI 1.9.9-2 Nginxui Nginx UI 1.9.9-3 Nginxui Nginx UI 1.9.9-4	111

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References