CVE-2024-22196

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
0xJacky	nginx-ui	< 2.0.0.beta.9

References

https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5bPatch
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879cExploit, Vendor Advisory
https://github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5bPatch
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879cExploit, Vendor Advisory

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-221978.8Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home CVE-2024-221988.8Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration set CVE-2024-221996.1This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulner CVE-2024-22203.5The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-222005.3vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, CVE-2024-222017.5Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it t CVE-2024-222026.5phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows a CVE-2024-222039.8Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the CVE-2024-222045.3Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration o CVE-2024-222059.8Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input CVE-2024-222069.8Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or CVE-2024-222075.3fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `