Skip to content
OpenAdvisories
Medium · 5.5 CVE-2024-49367 EUVD-2024-43404

Nginx UI's log path can be controlled

Published Oct 21, 2024 · Updated Oct 21, 2024 · Assigned by GitHub_M

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.

Affected products

VendorProductAffectedFixed
0xJacky nginx-ui < 2.0.0-beta.36 —

References