CVE-2024-49368

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-493699.8Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data CVE-2024-493704.9Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Ba CVE-2024-493734.3No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user ca CVE-2024-493759.0Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a m CVE-2024-493768.8Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in versi CVE-2024-493776.1OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected CVE-2024-493786.1smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox versions of smartUp 7.2.CVE-2024-493795.3Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scriptin CVE-2024-493807.5Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerab CVE-2024-493817.5Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulne CVE-2024-493824.3Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acroni CVE-2024-493834.3Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis