Kritik CVSS 9.9 PoC var
CVE-2026-44015: Nginx Ui: sunucu taraflı istek sahteciliği (SSRF)
Açıklama (NVD)
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
Özet bilgiler
- Ürün
- Nginxui Nginx Ui
- CVSS v3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- %0,32 (yüzdelik 25)
- CWE
- CWE-918
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| nginxui-nginx-ui | — | 2.3.4 | — |