Skip to main content

Breaking cybersecurity news

Vulnerability database

EU vulnerability data

Hands-on web security training

Security incidents database

Knowledge library

Analytics & trends

Follow us

Professional cybersecurity intelligence

Breaking cybersecurity news

Vulnerability database

EU vulnerability data

Hands-on web security training

Security incidents database

Knowledge library

Analytics & trends

Follow us

About Sources Sponsored Articles Status Legal Terms

v2.3.4•© 2026

Telegram Bluesky GitHub Contact

Return to CVE list

CVE-2024-49368

CVE-2024-49368

8.9

High

Published:21 Oct 2024

Last updated:17 Jun 2026

Source:security-advisories@github.com

Analyzed

Weakness (CWE)

CWE-20Improper Input Validation

CVSS Vector

v4.0

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Confidentiality (Vulnerable): High
Integrity (Vulnerable): High
Availability (Vulnerable): High
Confidentiality (Subsequent): None
Integrity (Subsequent): None
Availability (Subsequent): None

View on MITRE Find PoC on GitHub

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

References

security-advisories@github.com

https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36

security-advisories@github.com

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm