Medium
Security advisory
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-7634
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:08 UTC · Revision 1
Source evidence
NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.
osv:CVE-2024-7634
Complete source record
{
"id": "38c211e74d804124f10df0947038383ab5ad669e9630eeb3750e8a29b43ca5c1",
"url": "https://osv.dev/vulnerability/CVE-2024-7634",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-7634",
"summary": "NGINX Agent's \"config_dirs\" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.",
"evidence": "osv:CVE-2024-7634",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-7634",
"aliases": [
"BIT-nginx-agent-2024-7634",
"CVE-2024-7634"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nginx/agent",
"type": "GIT",
"events": [
{
"introduced": "9149ae8ff9ad3a481fb3c7b0c239cd167622022a"
},
{
"fixed": "3dc98f3e1b306d0897a64215817a5076a2182418"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:f5:nginx_agent:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.17.0"
},
{
"fixed": "2.37.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.36.1",
"sdk/v2.36.1",
"v2.36.0",
"sdk/v2.36.0",
"v2.35.1",
"sdk/v2.35.1",
"v2.35.0",
"sdk/v2.35.0",
"v2.34.1",
"sdk/v2.34.1",
"v2.34.0",
"sdk/v2.34.0",
"v2.33.0",
"sdk/v2.33.0",
"v2.32.2",
"sdk/v2.32.2",
"v2.32.1",
"sdk/v2.32.1",
"v2.32.0",
"sdk/v2.32.0",
"v2.31.2",
"sdk/v2.31.2",
"v2.31.1",
"sdk/v2.31.1",
"v2.31.0",
"sdk/v2.31.0",
"v2.30.3",
"sdk/v2.30.3",
"v2.30.2",
"sdk/v2.30.2",
"v2.30.1",
"sdk/v2.30.1",
"v2.30.0",
"sdk/v2.30.0",
"v2.29.0",
"sdk/v2.29.0",
"v2.28.0",
"sdk/v2.28.0",
"v2.27.0",
"sdk/v2.27.0",
"v2.26.0",
"sdk/v2.26.0",
"v2.25.0",
"sdk/v2.25.0",
"v2.24.1",
"v2.24.0",
"sdk/v2.24.1",
"sdk/v2.24.0",
"v2.23.0",
"sdk/v2.23.0",
"v2.22.1",
"sdk/v2.22.1",
"v2.22.0",
"sdk/v2.22.0",
"v2.17.0",
"sdk/v2.17.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7634.json"
}
}
],
"modified": "2026-10-24T10:30:24.977644444Z",
"provider": "osv",
"references": [
"https://my.f5.com/manage/s/article/K000140630"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "f5:nginx_instance_manager",
"extracted_events": [
{
"range": [
{
"introduced": "2.3.1"
},
{
"fixed": "2.17.2"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2024-7634",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431268,
"published_at": "2024-08-22T18:15:10.553+00:00"
}