7.5
CVE-2024-3736
- EPSS 0.92%
- Veröffentlicht 13.04.2024 14:15:07
- Zuletzt bearbeitet 21.08.2025 15:04:07
- Quelle cna@vuldb.com
- CVE-Watchlists
- Unerledigt
Logincym1102 nginxWebUI upload unrestricted upload
A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /adminPage/main/upload. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260575.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cym1102 ≫ Nginxwebui Version < 4.2.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.92% | 0.555 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| cna@vuldb.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
|
| cna@vuldb.com | 4 | 8 | 2.9 |
AV:N/AC:L/Au:S/C:N/I:N/A:P
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf
https://github.com/cym1102/nginxWebUI/issues/138
https://vuldb.com/?ctiid.260575
https://vuldb.com/?id.260575