CVE-2023-29004 (roxy-wi)

hap-wi/roxy-wi is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A Path Traversal vulnerability was found in the current version of Roxy-WI (6.3.9.0 at the moment of writing this report). The vulnerability can be exploited via an HTTP request to /app/options.py and the config_file_name parameter. Successful exploitation of this vulnerability could allow an attacker with user level privileges to obtain the content of arbitrary files on the file server within the scope of what the server process …

access apache app current cve exploitation exploited files function haproxy http interface lies modules nginx options parameter path path traversal privileges process report request root root-cause scope server servers version vulnerability web web interface writing