Improper Certificate Validation in cym1102 nginxWebUI Affects Remote Management

CVE-2024-3738

What is CVE-2024-3738?

A vulnerability has been identified in cym1102's nginxWebUI, affecting versions up to 3.9.9, specifically in the function handlePath within the file /adminPage/conf/saveCmd. This vulnerability arises from improper validation of the 'nginxPath' argument, which may allow attackers to bypass certificate checks. Attackers could leverage this weakness to execute remote attacks, potentially compromising sensitive configurations and leading to unauthorized access. The vulnerability is publicly disclosed and can be exploited if not promptly addressed. Users of affected versions are strongly encouraged to implement necessary security measures and follow patches provided by the vendor.

References