CVE-2024-49368
CRITICALCVSS v3
9.8
CRITICAL
EPSS Score
67.5%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.
Technical Details
- Published
- 10/21/2024
Frequently Asked Questions
What is CVE-2024-49368?
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.
Is CVE-2024-49368 actively exploited?
Active exploitation of CVE-2024-49368 has not been confirmed. The EPSS score is 67.5%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-49368?
CVE-2024-49368 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2024-49368 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.