Remote Code Execution Vulnerability in cym1102 nginxWebUI
CVE-2024-3740

6.3MEDIUM

Key Information:

Vendor

Cym1102

Status
Nginxwebui
Vendor
CVE Published:
13 April 2024

Badges

👾 Exploit Exists

What is CVE-2024-3740?

A significant vulnerability affects cym1102's nginxWebUI, specifically versions up to 3.9.9. The issue lies in the function 'exec' within the '/adminPage/conf/reload' file, where manipulation of the 'nginxExe' argument leads to a deserialization flaw. This vulnerability can be exploited remotely, raising serious security concerns. The exploit has already been disclosed, making it imperative for users to secure their installations to prevent potential unauthorized access and exploitation. It is advisable for users to review security patches and implement protective measures promptly.

Affected Version(s)

nginxWebUI 3.9.0

nginxWebUI 3.9.1

nginxWebUI 3.9.2

References

https://vuldb.com/?id.260579
vdb-entrytechnical-description
https://vuldb.com/?ctiid.260579
signaturepermissions-required
https://vuldb.com/?submit.311216
third-party-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

qqwp220 (VulDB User)
.