CVE-2022-31161

🗓️ 15 Jul 2022 00:00:00Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 96 Views🌐 WEB

Roxy-WI Web interface allows remote code execution pre 6.1.1.

Reporter	Title	Published	Views	Family All 14
0day.today	Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution via ssl_cert Upload Vulnerability	3 Apr 202300:00	–	zdt
Circl	CVE-2022-31161	16 Jul 202200:20	–	circl
CNNVD	Roxy-WI 命令注入漏洞	15 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-31161 Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload	15 Jul 202200:00	–	cvelist
Exploit DB	Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload	3 Apr 202300:00	–	exploitdb
Nuclei	Roxy-WI - Remote Code Execution	2 Jul 202609:36	–	nuclei
NVD	CVE-2022-31161	15 Jul 202221:15	–	nvd
OSV	CVE-2022-31161 Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload	15 Jul 202200:00	–	osv
Packet Storm	Roxy WI 6.1.1.0 Remote Code Execution	3 Apr 202300:00	–	packetstorm
Prion	Design/Logic Flaw	15 Jul 202221:15	–	prion

NVD

Vulners

Node

roxy-wi roxy-wiRange<6.1.1.0

[
  {
    "vendor": "hap-wi",
    "product": "roxy-wi",
    "versions": [
      {
        "version": "< 6.1.1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0
packetstormsecurity	www.packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html
github	www.github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483

Parameter	Position	Path	Description	CWE
show_versions	request body	/app/options.py	Unauthenticated remote code execution via ssl_cert upload on /app/options.py (CVE-2022-31161).	CWE-77, CWE-94, CWE-434
token	request body	/app/options.py	Unauthenticated remote code execution via ssl_cert upload on /app/options.py (CVE-2022-31161).	CWE-77, CWE-94, CWE-434
alert_consumer	request body	/app/options.py	Unauthenticated remote code execution via ssl_cert upload on /app/options.py (CVE-2022-31161).	CWE-77, CWE-94, CWE-434
serv	request body	/app/options.py	Unauthenticated remote code execution via ssl_cert upload on /app/options.py (CVE-2022-31161).	CWE-77, CWE-94, CWE-434
delcert	request body	/app/options.py	Unauthenticated remote code execution via ssl_cert upload on /app/options.py (CVE-2022-31161).	CWE-77, CWE-94, CWE-434