Lucene search

GitHub_MCVELIST:CVE-2023-25803

HistoryMar 13, 2023 - 12:00 a.m.

CVE-2023-25803

2023-03-1300:00:00

CWE-22

GitHub_M

www.cve.org

cve-2023-25803

haproxy

nginx

apache

keepalived

directory traversal

server-side file inclusion

version 6.3.5.0

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

51.9%

JSON

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that allows the inclusion of server-side files. This issue is fixed in version 6.3.5.0.

CNA Affected

[
  {
    "vendor": "hap-wi",
    "product": "roxy-wi",
    "versions": [
      {
        "version": "< 6.3.5.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/hap-wi/roxy-wi/security/advisories/GHSA-cv9w-j9gh-5j3w

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

51.9%

JSON

Related for CVELIST:CVE-2023-25803