CVE-2024-3738
A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. This affects the function handlePath of the file /adminPage/conf/saveCmd. The manipulation of the argument nginxPath leads to improper certificate validation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260577 was assigned to this vulnerability.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.52% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- cym1102/nginxwebui
- Source
- cna@vuldb.com
References
- https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdfExploit
- https://github.com/cym1102/nginxWebUI/issues/138Issue Tracking
- https://vuldb.com/?ctiid.260577Permissions Required, VDB Entry
- https://vuldb.com/?id.260577Third Party Advisory, VDB Entry
- https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdfExploit
- https://github.com/cym1102/nginxWebUI/issues/138Issue Tracking
- https://vuldb.com/?ctiid.260577Permissions Required, VDB Entry
- https://vuldb.com/?id.260577Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.