CVE-2023-25802

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize `dir/../filename` sequences, such as `/etc/nginx/../passwd`, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-26 CWE-668

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-258037.5Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a directory traversal CVE-2023-258045.3Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traver CVE-2023-258059.8versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to ve CVE-2023-258065.3OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy CVE-2023-258075.4DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified CVE-2023-258096.3runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless r CVE-2023-258105.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users CVE-2023-258115.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. U CVE-2023-258128.8Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio CVE-2023-258139.8Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are pa CVE-2023-258146.5metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file th CVE-2023-258152.2In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to