CVE-2023-27224 : An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbit

An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file.

Published 2023-03-22 20:15:13

Updated 2023-03-27 22:24:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-27224

Jc21 » Nginx Proxy Manager » Version: 2.9.19
cpe:2.3:a:jc21:nginx_proxy_manager:2.9.19:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.32%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

https://github.com/LinuxProgramDevelop/NginxProxyManagerCommandInjectVulnInfo/blob/main/Nginx_proxy_manager_Command_Inject_vulnerability.pdf

NginxProxyManagerCommandInjectVulnInfo/Nginx_proxy_manager_Command_Inject_vulnerability.pdf at main · LinuxProgramDevelop/NginxProxyManagerCommandInjectVulnInfo · GitHub
Exploit;Third Party Advisory
https://github.com/NginxProxyManager/nginx-proxy-manager

GitHub - NginxProxyManager/nginx-proxy-manager: Docker container for managing Nginx proxy hosts with a simple, powerful interface
Product

Jump to