Vulnerabilities > CVE-2022-31161 - Unspecified vulnerability in Roxy-Wi

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

roxy-wi

critical

NVD

Published: 2022-07-15

Updated: 2024-11-21

Summary

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.

Vulnerable Configurations

Part	Description	Count
Application	Roxy-Wi Roxy WI Roxy WI - Roxy WI Roxy WI 1.0 Roxy WI Roxy WI 1.1 Roxy WI Roxy WI 1.3 Roxy WI Roxy WI 1.4 Roxy WI Roxy WI 1.4.1 Roxy WI Roxy WI 1.6 Roxy WI Roxy WI 1.9.1 Roxy WI Roxy WI 1.10 Roxy WI Roxy WI 1.10.1 Roxy WI Roxy WI 1.10.2 Roxy WI Roxy WI 1.10.2.1 Roxy WI Roxy WI 2.0.2 Roxy WI Roxy WI 3.2.13 Roxy WI Roxy WI 3.3 Roxy WI Roxy WI 3.4.4.6 Roxy WI Roxy WI 3.4.4.7 Roxy WI Roxy WI 3.4.5 Roxy WI Roxy WI 3.4.5.1 Roxy WI Roxy WI 4.4.1.0 Roxy WI Roxy WI 5.1.1.0 Roxy WI Roxy WI 5.1.4.0 Roxy WI Roxy WI 5.2.0 Roxy WI Roxy WI 5.2.1 Roxy WI Roxy WI 5.2.2.0 Roxy WI Roxy WI 5.2.3.0 Roxy WI Roxy WI 5.2.4.0 Roxy WI Roxy WI 5.2.5.0 Roxy WI Roxy WI 5.2.6.0 Roxy WI Roxy WI 5.3.0.0 Roxy WI Roxy WI 5.3.1.0 Roxy WI Roxy WI 5.3.2.0 Roxy WI Roxy WI 5.3.3.0 Roxy WI Roxy WI 5.3.4.0 Roxy WI Roxy WI 5.3.5.0 Roxy WI Roxy WI 5.3.6.0 Roxy WI Roxy WI 5.4.0.0 Roxy WI Roxy WI 5.4.1.0 Roxy WI Roxy WI 5.4.2.0 Roxy WI Roxy WI 5.4.3.0 Roxy WI Roxy WI 5.5.0.0 Roxy WI Roxy WI 5.5.1.0 Roxy WI Roxy WI 6.0.0.0 Roxy WI Roxy WI 6.0.1.0 Roxy WI Roxy WI 6.0.2.0 Roxy WI Roxy WI 6.0.3.0 Roxy WI Roxy WI 6.1.0.0	47

Summary

Vulnerable Configurations

References