Nginx 1.5.13 < 1.26.2 Buffer Over-read

2024-09-0600:00:00

www.tenable.com

nginx version

buffer over-read

no source data

scanner

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS4

5.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:N

AI Score

4.9

Confidence

High

JSON

According to its Server response header, the installed version of nginx is 1.5.13 to 1.26.2 or 1.27.0. It is, therefore, affected by a security issue was identified in the ngx_http_mp4_module, which might allow an attacker to cause a worker process crash by using a specially crafted mp4 file (CVE-2024-7347).

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.