CVE-2023-25802

Katalog CVE

CVSS 7.5 · High EPSS 1,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada roxy-wi. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.

Rincian

Terbit di NVD

13 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-26: Path Traversal: '/dir/../filename'
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-qcmp-q5h3-784m exploit · advisory vendor
• https://github.com/hap-wi/roxy-wi/commit/0054f25da7cf8c7480452f48e39308b5e392dc67 patch