Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2024-22196
Good to know:
Date: January 11, 2024
Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using "DefaultQuery", the ""desc"" and ""id"" values are used as default values if the query parameters are not set. Thus, the "order" and "sort_by" query parameter are user-controlled and are being appended to the "order" variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.
Language: Go
Severity Score
Related Resources (9)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89Top Fix
Upgrade Version
Upgrade to version github.com/0xJacky/Nginx-UI - v1.9.10-0.20231219195202-ec93ab05a3ec
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | HIGH |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | LOW |
| Availability (A): | LOW |