CVE-2024-23827 | Nginx-UI arbitrary file write through the Import Certificate feature

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.

Published: 2024-01-29 Last update: 2024-11-21 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2024-23827 is rated Moderate Risk (53.8/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.70%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2024-23827

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 2.96% 0.70% -2.27%
2 2025-11-21 5.78% 2.96% -2.81%
3 2025-11-18 — 5.78% —

Full EPSS history (11 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-23827

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
9.8 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.9 [email protected]
9.8 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 5.9 [email protected]

Weakness enumeration for CVE-2024-23827

GitHub Security Advisory for CVE-2024-23827

GHSA-xvq9-4vpv-227m · Severity: critical · Ecosystem: go — Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature

Affected software / configurations for CVE-2024-23827

Vendor Product Version Raw CPE
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:-:*:*:*:*:*:*
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:alpha2:*:*:*:*:*:*
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:alpha3:*:*:*:*:*:*
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:alpha4:*:*:*:*:*:*
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:rc1:*:*:*:*:*:*
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:rc2:*:*:*:*:*:*
nginxui nginx_ui 1.2.0 cpe:2.3:a:nginxui:nginx_ui:1.2.0:rc3:*:*:*:*:*:*
nginxui nginx_ui 1.2.1 cpe:2.3:a:nginxui:nginx_ui:1.2.1:*:*:*:*:*:*:*
nginxui nginx_ui 1.2.2 cpe:2.3:a:nginxui:nginx_ui:1.2.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.3.0 cpe:2.3:a:nginxui:nginx_ui:1.3.0:-:*:*:*:*:*:*
nginxui nginx_ui 1.3.0 cpe:2.3:a:nginxui:nginx_ui:1.3.0:rc1:*:*:*:*:*:*
nginxui nginx_ui 1.3.1 cpe:2.3:a:nginxui:nginx_ui:1.3.1:-:*:*:*:*:*:*
nginxui nginx_ui 1.3.1 cpe:2.3:a:nginxui:nginx_ui:1.3.1:fix:*:*:*:*:*:*
nginxui nginx_ui 1.3.2 cpe:2.3:a:nginxui:nginx_ui:1.3.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.3.3 cpe:2.3:a:nginxui:nginx_ui:1.3.3:rc1:*:*:*:*:*:*
nginxui nginx_ui 1.4.0 cpe:2.3:a:nginxui:nginx_ui:1.4.0:-:*:*:*:*:*:*
nginxui nginx_ui 1.4.0 cpe:2.3:a:nginxui:nginx_ui:1.4.0:rc1:*:*:*:*:*:*
nginxui nginx_ui 1.4.1 cpe:2.3:a:nginxui:nginx_ui:1.4.1:*:*:*:*:*:*:*
nginxui nginx_ui 1.4.2 cpe:2.3:a:nginxui:nginx_ui:1.4.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:-:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta1:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta2:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta3:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta4:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta4_fix:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta5:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta6:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta7:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta8:*:*:*:*:*:*
nginxui nginx_ui 1.5.0 cpe:2.3:a:nginxui:nginx_ui:1.5.0:beta9:*:*:*:*:*:*
nginxui nginx_ui 1.5.1 cpe:2.3:a:nginxui:nginx_ui:1.5.1:*:*:*:*:*:*:*
nginxui nginx_ui 1.5.2 cpe:2.3:a:nginxui:nginx_ui:1.5.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.0 cpe:2.3:a:nginxui:nginx_ui:1.6.0:-:*:*:*:*:*:*
nginxui nginx_ui 1.6.0 cpe:2.3:a:nginxui:nginx_ui:1.6.0:fix:*:*:*:*:*:*
nginxui nginx_ui 1.6.1 cpe:2.3:a:nginxui:nginx_ui:1.6.1:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.2 cpe:2.3:a:nginxui:nginx_ui:1.6.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.3 cpe:2.3:a:nginxui:nginx_ui:1.6.3:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.5 cpe:2.3:a:nginxui:nginx_ui:1.6.5:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.6 cpe:2.3:a:nginxui:nginx_ui:1.6.6:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.7 cpe:2.3:a:nginxui:nginx_ui:1.6.7:*:*:*:*:*:*:*
nginxui nginx_ui 1.6.8 cpe:2.3:a:nginxui:nginx_ui:1.6.8:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.0 cpe:2.3:a:nginxui:nginx_ui:1.7.0:-:*:*:*:*:*:*
nginxui nginx_ui 1.7.0 cpe:2.3:a:nginxui:nginx_ui:1.7.0:patch:*:*:*:*:*:*
nginxui nginx_ui 1.7.1 cpe:2.3:a:nginxui:nginx_ui:1.7.1:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.2 cpe:2.3:a:nginxui:nginx_ui:1.7.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.3 cpe:2.3:a:nginxui:nginx_ui:1.7.3:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.4 cpe:2.3:a:nginxui:nginx_ui:1.7.4:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.5 cpe:2.3:a:nginxui:nginx_ui:1.7.5:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.6 cpe:2.3:a:nginxui:nginx_ui:1.7.6:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.7 cpe:2.3:a:nginxui:nginx_ui:1.7.7:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.8 cpe:2.3:a:nginxui:nginx_ui:1.7.8:*:*:*:*:*:*:*
nginxui nginx_ui 1.7.9 cpe:2.3:a:nginxui:nginx_ui:1.7.9:*:*:*:*:*:*:*
nginxui nginx_ui 1.8.0 cpe:2.3:a:nginxui:nginx_ui:1.8.0:*:*:*:*:*:*:*
nginxui nginx_ui 1.8.1 cpe:2.3:a:nginxui:nginx_ui:1.8.1:*:*:*:*:*:*:*
nginxui nginx_ui 1.8.2 cpe:2.3:a:nginxui:nginx_ui:1.8.2:*:*:*:*:*:*:*
nginxui nginx_ui 1.8.3 cpe:2.3:a:nginxui:nginx_ui:1.8.3:*:*:*:*:*:*:*
nginxui nginx_ui 1.8.4 cpe:2.3:a:nginxui:nginx_ui:1.8.4:-:*:*:*:*:*:*
nginxui nginx_ui 1.8.4 cpe:2.3:a:nginxui:nginx_ui:1.8.4:patch:*:*:*:*:*:*
nginxui nginx_ui 1.9.9 cpe:2.3:a:nginxui:nginx_ui:1.9.9:*:*:*:*:*:*:*
nginxui nginx_ui 1.9.9-1 cpe:2.3:a:nginxui:nginx_ui:1.9.9-1:*:*:*:*:*:*:*
nginxui nginx_ui 1.9.9-2 cpe:2.3:a:nginxui:nginx_ui:1.9.9-2:*:*:*:*:*:*:*
nginxui nginx_ui 1.9.9-3 cpe:2.3:a:nginxui:nginx_ui:1.9.9-3:*:*:*:*:*:*:*
nginxui nginx_ui 1.9.9-4 cpe:2.3:a:nginxui:nginx_ui:1.9.9-4:*:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*
nginxui nginx_ui 2.0.0 cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:*

References for CVE-2024-23827

cvelogic Threat Intelligence