CVE-2024-39935

{"id": "CVE-2024-39935", "cveTags": [], "metrics": {}, "published": "2024-07-04T21:15:10.077", "references": [{"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/commit/99cce7e2b0da2978411cedd7cac5fffbe15bc46", "source": "cve@mitre.org"}, {"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/compare/v2.11.2...v2.11.3", "source": "cve@mitre.org"}, {"url": "https://github.com/NginxProxyManager/nginx-proxy-manager/issues/3662", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificate management privileges) via untrusted input to the DNS provider configuration. NOTE: this is not part of any NGINX software shipped by F5."}, {"lang": "es", "value": "jc21 NGINX Proxy Manager anterior a 2.11.3 permite la inyecci\u00f3n de comandos del sistema operativo backend/internal/certificate.js por parte de un usuario autenticado (con privilegios de administraci\u00f3n de certificados) a trav\u00e9s de entradas no confiables en la configuraci\u00f3n del proveedor de DNS. NOTA: esto no forma parte de ning\u00fan software NGINX enviado por F5."}], "lastModified": "2024-07-05T12:55:51.367", "sourceIdentifier": "cve@mitre.org"}