CVE-2023-23596

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jan 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235976.5A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `fi CVE-2023-235986.5Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dr CVE-2023-235996.5When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow CVE-2023-23607.5Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) befor CVE-2023-236006.5Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was grante CVE-2023-236016.5Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks CVE-2023-236026.5A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. Th CVE-2023-236036.5Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting fo CVE-2023-236046.5A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This cou CVE-2023-236058.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs CVE-2023-236068.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs showed evidence of me CVE-2023-236079.8erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to ex