UpHeron
All vulnerabilities

Servers and applications

CVE-2024-49368

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

Severity
High 8.9
Published
21 Oct 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Nginx UIServers and applications · cpe:a:nginxui:nginx_ui
  • Version 2.0.0-beta35
  • Version 2.0.0-beta34
  • Version 2.0.0-beta33
  • Version 2.0.0-beta32-patch1
All 49 release lines
  • Every version up to 1.9.9-4
  • Version 2.0.0-beta1
  • Version 2.0.0-beta2
  • Version 2.0.0-beta3
  • Version 2.0.0-beta4
  • Version 2.0.0-beta4_patch
  • Version 2.0.0-beta5
  • Version 2.0.0-beta5_patch
  • Version 2.0.0-beta6
  • Version 2.0.0-beta6_patch
  • Version 2.0.0-beta6_patch2
  • Version 2.0.0-beta7
  • Version 2.0.0-beta8
  • Version 2.0.0-beta8_patch
  • Version 2.0.0-beta9
  • Version 2.0.0-beta10
  • Version 2.0.0-beta10_patch
  • Version 2.0.0-beta11
  • Version 2.0.0-beta12
  • Version 2.0.0-beta13
  • Version 2.0.0-beta13-patch
  • Version 2.0.0-beta14
  • Version 2.0.0-beta15
  • Version 2.0.0-beta16
  • Version 2.0.0-beta17
  • Version 2.0.0-beta18
  • Version 2.0.0-beta18-patch1
  • Version 2.0.0-beta18-patch2
  • Version 2.0.0-beta19
  • Version 2.0.0-beta20
  • Version 2.0.0-beta21
  • Version 2.0.0-beta22
  • Version 2.0.0-beta23
  • Version 2.0.0-beta23-patch1
  • Version 2.0.0-beta23-ptach2
  • Version 2.0.0-beta24
  • Version 2.0.0-beta25
  • Version 2.0.0-beta25-patch1
  • Version 2.0.0-beta25-ptach2
  • Version 2.0.0-beta27
  • Version 2.0.0-beta28
  • Version 2.0.0-beta29
  • Version 2.0.0-beta30
  • Version 2.0.0-beta31
  • Version 2.0.0-beta32
  • Version 2.0.0-beta32-patch1
  • Version 2.0.0-beta33
  • Version 2.0.0-beta34
  • Version 2.0.0-beta35

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-49368
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-49368