PT-2018-15227 · Nginx · Verynginx

Algtm · Publicado 2018-12-10 · Atualizado 2020-08-24 · CVE-2018-19991

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VeryNginx version 0.3.3

Description The issue allows remote attackers to bypass the Web Application Firewall feature due to the lack of an error handler for functions such as get uri args or get post args, which can lead to API misuse.

Recommendations For VeryNginx version 0.3.3, consider implementing a custom error handler to block potential API misuse until a patch is available. As a temporary workaround, review and restrict access to sensitive API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

CVE-2018-19991

Produtos afetados

Verynginx

Referências · 3

• 🔥 https://github.com/alexazhou/VeryNginx/issues/218 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19991 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19991 · Aviso do Fabricante