Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zoraxy: Authenticated Path Traversal in Config Import leads to RCE
Vulnerability Description
Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. Prior to version 3.3.2, an authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin. Version 3.3.2 patches the issue.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
Zoraxy 路径遍历漏洞
Vulnerability Description
Zoraxy是Toby Chui个人开发者的一个通用的 HTTP 反向代理和转发工具。 Zoraxy 3.3.2之前版本存在路径遍历漏洞，该漏洞源于配置导入端点存在经过身份验证的路径遍历，可能导致任意文件写入和远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A