CVE-2024-46257

Katalog CVE

CVSS 6.3 · Medium EPSS 1,3%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada jc21 nginx proxy manager. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via Add Let's Encrypt Certificate. NOTE: this is not part of any NGINX software shipped by F5.

Rincian

Terbit di NVD

27 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bbb8... patch
• https://github.com/barttran2k/POC_CVE-2024-46256 exploit
• https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.11.3/backend/internal/certificate.js#L870 product
• https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc466 product