{"affected":[{"product":"nginx-ui","source":"CNA: GitHub_M","vendor":"0xJacky","versions":[{"status":"affected","version":"< 2.0.0-beta.36"}]},{"defaultStatus":"unknown","product":"nginx_ui","source":"ADP: CISA-ADP","vendor":"nginxui","versions":[{"lessThan":"2.0.0-beta.36","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*","versionEndIncluding":"1.9.9-4","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta12:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta13:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta13-patch:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta14:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta15:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta16:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta17:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18-patch1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18-patch2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta19:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta20:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta21:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta22:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23-patch1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23-ptach2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta24:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25-patch1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25-ptach2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta27:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta28:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta29:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta30:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta31:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta32:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta32-patch1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta33:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta34:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta35:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-49368","cwes":["CWE-20"],"description":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.","epss":{"date":"2026-11-03","percentile":0.98086,"score":0.27668},"exploits":[{"kind":"exploit","source":"security-advisories@github.com","url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm"}],"kev":null,"metrics":[{"score":8.9,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","version":"4.0"},{"score":8.9,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":9.8,"severity":"critical","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793744246010,"publishedAt":1729530283652,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm"}],"remediation":[],"revision":"7798f89fc486753f04e52635998ba2cfb79225bbdbb4495d3feede244d9ef856","sources":[{"modifiedAt":1793742762322,"name":"CNA: GitHub_M","retrievedAt":1793744053257,"url":"https://www.cve.org/CVERecord?id=CVE-2024-49368"},{"modifiedAt":1793744246010,"name":"NVD","retrievedAt":1793751365361,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49368"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793744100896,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-49368"}],"ssvc":{"assessedAt":1730433323533,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Unchecked logrotate settings lead to arbitrary command execution","updatedAt":1793751365361}