VulnerabilityModified
CVE-2023-23596
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection.
HIGH 8.8EPSS 15.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 15.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 15.20% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- jc21/nginx proxy manager
- Source
- cve@mitre.org
References
- https://advisory.dw1.io/57Exploit, Third Party Advisory
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510Exploit, Third Party Advisory
- https://advisory.dw1.io/57Exploit, Third Party Advisory
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/4f10d129c20cc82494b95cc94b97f859dbd4b54d/backend/internal/access-list.js#L510Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.