CVE-2022-31125
Authentication Bypass in Roxy-wi
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
Roxy-wi es una interfaz web de código abierto para administrar servidores Haproxy, Nginx, Apache y Keepalived. Una vulnerabilidad en Roxy-wi permite a un atacante remoto no autenticado omitir la autenticación y acceder a la funcionalidad de administración mediante el envío de una petición HTTP especialmente diseñada. Esto afecta a Roxywi versiones anteriores a 6.1.1.0. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para este problema
Roxy WI version 6.1.0.0 suffers from an improper authentication control vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-18 CVE Reserved
- 2022-07-06 CVE Published
- 2023-04-03 First Exploit
- 2024-08-03 CVE Updated
- 2024-08-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-287: Improper Authentication
CAPEC
References (3)
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/51226 | 2023-04-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|