CVE-2023-45539

2023-12-0400:00:00

ubuntu.com

haproxy

security

uri

vulnerability

remote attackers

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.8%

JSON

HAProxy before 2.8.2 accepts # as part of the URI component, which might
allow remote attackers to obtain sensitive information or have unspecified
other impact upon misinterpretation of a path_end rule, such as routing
index.html#.png to a static server.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchhaproxy< anyUNKNOWN
ubuntu20.04noarchhaproxy< 2.0.31-0ubuntu0.3UNKNOWN
ubuntu22.04noarchhaproxy< 2.4.22-0ubuntu0.22.04.3UNKNOWN
ubuntu23.04noarchhaproxy< 2.6.9-1ubuntu1.2UNKNOWN
ubuntu16.04noarchhaproxy< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	haproxy	< any	UNKNOWN
ubuntu	20.04	noarch	haproxy	< 2.0.31-0ubuntu0.3	UNKNOWN
ubuntu	22.04	noarch	haproxy	< 2.4.22-0ubuntu0.22.04.3	UNKNOWN
ubuntu	23.04	noarch	haproxy	< 2.6.9-1ubuntu1.2	UNKNOWN
ubuntu	16.04	noarch	haproxy	< any	UNKNOWN