Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-9BDAE53EAF8514AB4008A5C94CFEEB19Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
6.7 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.2%
Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thus, the order and sort_by query parameter are user-controlled and are being appended to the order variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| go/github.com/0xjacky/nginx-ui | lt | v2.0.0.beta.9 |
References
github.com/0xjacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/model/model.go#L278-L287
github.com/0xjacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/model/model.go#L91
github.com/0xjacky/nginx-ui/blob/04bf8ec487f06ab17a9fb7f34a28766e5f53885e/model/model.go#L99C4
github.com/0xJacky/nginx-ui/commit/ec93ab05a3ecbb6bcf464d9dca48d74452df8a5b
github.com/0xJacky/nginx-ui/security/advisories/GHSA-h374-mm57-879c
github.com/advisories/GHSA-h374-mm57-879c
nvd.nist.gov/vuln/detail/CVE-2024-22196
Related
7 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
6.7 Medium
AI Score
Confidence
Low
0.0005 Low
EPSS
Percentile
18.2%