CVE-2022-31125

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to bypass authentication and access admin functionality by sending a specially crafted HTTP request. This affects Roxywi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jul 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-311269.8Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remoCVE-2022-311276.1NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-maCVE-2022-311285.4Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not CVE-2022-311297.5moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to uCVE-2022-31135.5An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.CVE-2022-311307.5Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could lCVE-2022-311314.3Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing userCVE-2022-311329.8Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `CVE-2022-311334.8HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerCVE-2022-311344.9Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server ownCVE-2022-311357.5Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of AkCVE-2022-311366.1Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sanitize html being re