PT-2022-2154 · Nginx · Nginx

Published 2022-04-09 · Updated 2022-04-09

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nginx (affected versions not specified)

Description The issue is related to errors in the code of the LDAP-auth HTTP server demon implementation in nginx. Exploitation of this issue may allow a remote attacker to execute arbitrary code in the vulnerable system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

CWE-17

Related Identifiers

BDU:2022-02111

Affected Products

Nginx

References · 6

• https://bdu.fstec.ru/vul/2022-02111 · Security Note
• https://github.com/AgainstTheWest/NginxDay · Note
• https://twitter.com/Gi7w0rm/status/1512789855197093891 · Note
• https://nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/?utm_medium=owned-social&utm_source=twitter&utm_campaign=ww-nx_sec_g&utm_content=bg- · Note
• https://nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/?utm_medium=owned-social&utm_source=twitter&utm_campaign=ww-nx_sec_g&utm_content=bg- · Note
• https://securityonline.info/nginx-zero-day-rce-vulnerability-alert · Note