PT-2023-8863 · Haproxy+10 · Haproxy+10
Ben Kallus
·
Published
2023-11-28
·
Updated
2026-03-10
·
CVE-2023-45539
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:C/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
HAProxy versions prior to 2.8.2
Description
The issue is related to HAProxy accepting # as part of the URI component. This could allow remote attackers to obtain sensitive information or have other unspecified impacts due to the misinterpretation of a path end rule. For example, it might route index.html#.png to a static server.
Recommendations
For versions prior to 2.8.2, update to version 2.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information that could be exposed through the misinterpretation of URI components.
Fix
Authentication Bypass Using an Alternate Path or Channel
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Haproxy
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu