CVE-2022-31161
Critical
Description
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.
SeverityCritical
CVSS10.0
Exploit probability—
ProductRoxy-wi
PublishedJul 15, 2022
First seenJul 15, 2022
Weakness typeCWE-77Command injectionCWE-94Code injection
How to fix
Update
- roxy-wi roxy-wi6.1.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| roxy-wi roxy-wi | v < 6.1.1.0 | 6.1.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.