CVE-2024-46257

MEDIUM EPSS 66.4%
Published Sep 27, 20241y ago · Modified Jun 17, 20261w ago
6.3 CVSS 3.1
Medium
Find Similar
Published Sep 27, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote code execution via Add Let's Encrypt Certificate. NOTE: this is not part of any NGINX software shipped by F5.

CVSS Details

Base Score
6.3
Exploitability
2.8
Impact
3.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
66.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
jc21nginx_proxy_manager2.11.3any

References 4

  • github.com https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.11.3/backend/internal/certificate.js#L870
    Product
  • github.com https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc466
    Product
  • github.com https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bbb810a05
    Patch
  • github.com https://github.com/barttran2k/POC_CVE-2024-46256
    Exploit

Remediation

  • github.com https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4073/commits/c39d5433bcd13993def222bbb2b6988bbb810a05
    Patch