Logo
Retour à la veille

CVE-2026-84315

Publié : 12 octobre 2026
Modifié : 12 octobre 2026
Lien officiel NVD
Score CVSS
8.3
HIGH

Description détaillée

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME users, Nginx control settings, and site or stream automation without completing the OTP or passkey step-up. This issue is fixed in version 2.4.1.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Références et Patchs

https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5v7c-xpfp-p65m

Dernières Vulnérabilités

CVE-2026-93892

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.

VOIR DÉTAILS

CVE-2026-93891

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.

VOIR DÉTAILS

CVE-2026-92832

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.

VOIR DÉTAILS