by Kastro
Paper/Archive/CVE-2024-3739

CVE-2024-3739

cym1102 nginxWebUI — cym1102 nginxWebUI upload os command injection

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 86.9.869 × 2017.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-260578 is the identifier assigned to this vulnerability.

Affected

ProductAffectedFixed inSource
nginxWebUI3.9.0–CNA
nginxWebUI3.9.1–CNA
nginxWebUI3.9.2–CNA
nginxWebUI3.9.3–CNA
nginxWebUI3.9.4–CNA
nginxWebUI3.9.5–CNA
nginxWebUI3.9.6–CNA
nginxWebUI3.9.7–CNA
nginxWebUI3.9.8–CNA
nginxWebUI3.9.9–CNA
nginxwebui3.9.0–CISA-ADP
nginxwebui3.9.1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.260578refvuldb.com/?ctiid.260578refgithub.com/cym1102/nginxWebUI/issues/138exploitgithub.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf