UpHeron
All vulnerabilities

Servers and applications

CVE-2024-49366

Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.

Severity
High 7.7
Published
21 Oct 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Nginx UIServers and applications · cpe:a:nginxui:nginx_ui
  • Version 2.0.0-beta35
  • Version 2.0.0-beta34
  • Version 2.0.0-beta33
  • Version 2.0.0-beta32-patch1
All 49 release lines
  • Every version up to 1.9.9-4
  • Version 2.0.0-beta1
  • Version 2.0.0-beta2
  • Version 2.0.0-beta3
  • Version 2.0.0-beta4
  • Version 2.0.0-beta4_patch
  • Version 2.0.0-beta5
  • Version 2.0.0-beta5_patch
  • Version 2.0.0-beta6
  • Version 2.0.0-beta6_patch
  • Version 2.0.0-beta6_patch2
  • Version 2.0.0-beta7
  • Version 2.0.0-beta8
  • Version 2.0.0-beta8_patch
  • Version 2.0.0-beta9
  • Version 2.0.0-beta10
  • Version 2.0.0-beta10_patch
  • Version 2.0.0-beta11
  • Version 2.0.0-beta12
  • Version 2.0.0-beta13
  • Version 2.0.0-beta13-patch
  • Version 2.0.0-beta14
  • Version 2.0.0-beta15
  • Version 2.0.0-beta16
  • Version 2.0.0-beta17
  • Version 2.0.0-beta18
  • Version 2.0.0-beta18-patch1
  • Version 2.0.0-beta18-patch2
  • Version 2.0.0-beta19
  • Version 2.0.0-beta20
  • Version 2.0.0-beta21
  • Version 2.0.0-beta22
  • Version 2.0.0-beta23
  • Version 2.0.0-beta23-patch1
  • Version 2.0.0-beta23-ptach2
  • Version 2.0.0-beta24
  • Version 2.0.0-beta25
  • Version 2.0.0-beta25-patch1
  • Version 2.0.0-beta25-ptach2
  • Version 2.0.0-beta27
  • Version 2.0.0-beta28
  • Version 2.0.0-beta29
  • Version 2.0.0-beta30
  • Version 2.0.0-beta31
  • Version 2.0.0-beta32
  • Version 2.0.0-beta32-patch1
  • Version 2.0.0-beta33
  • Version 2.0.0-beta34
  • Version 2.0.0-beta35

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-49366
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-49366