CVE-2024-22196
High
Description
Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.
SeverityHigh
CVSS7.0
Exploit probability—
ProductNginxui Nginx Ui
PublishedJan 11, 2024
First seenJan 11, 2024
Weakness typeCWE-89SQL injection
How to fix
Update
- nginxui nginx_ui2.0.0 or later
- github.com/0xJacky/Nginx-UI1.9.10-0.20231219195202-ec93ab05a3ec or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx_ui | v < 2.0.0, 2.0.0 | 2.0.0 |
| github.com/0xJacky/Nginx-UIGo | v < 1.9.10-0.20231219195202-ec93ab05a3ec | 1.9.10-0.20231219195202-ec93ab05a3ec |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.