Lucene search

GitHub_MCVE-2023-25803

HistoryMar 13, 2023 - 8:15 p.m.

CVE-2023-25803

2023-03-1320:15:15

CWE-22

GitHub_M

web.nvd.nist.gov

roxy-wi

directory traversal

vulnerability

version 6.3.5.0

security issue

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

54.5%

JSON

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal vulnerability that allows the inclusion of server-side files. This issue is fixed in version 6.3.5.0.

Affected configurations

Nvd

Vulners

Node

roxy-wiroxy-wiRange<6.3.5.0

VendorProductVersionCPE
roxy-wiroxy-wi*cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
roxy-wi	roxy-wi	*	cpe:2.3:a:roxy-wi:roxy-wi::::::::

CNA Affected

[
  {
    "vendor": "hap-wi",
    "product": "roxy-wi",
    "versions": [
      {
        "version": "< 6.3.5.0",
        "status": "affected"
      }
    ]
  }
]

References

github.com/hap-wi/roxy-wi/security/advisories/GHSA-cv9w-j9gh-5j3w

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

54.5%

JSON

Related for CVE-2023-25803