HAProxy up to 12.0.23/2.2.15/2.3.12/2.4.2 HTTP Method /admin access control

Summaryinfo

A vulnerability was found in HAProxy up to 12.0.23/2.2.15/2.3.12/2.4.2. It has been classified as critical. This impacts an unknown function of the file /admin of the component HTTP Method Handler. The manipulation leads to access control. This vulnerability is referenced as CVE-2021-39241. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in HAProxy up to 12.0.23/2.2.15/2.3.12/2.4.2 (Firewall Software). It has been rated as critical. This issue affects an unknown code block of the file /admin of the component HTTP Method Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability.

The weakness was published 08/18/2021. The advisory is shared at mail-archive.com. The identification of this vulnerability is CVE-2021-39241. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 2.0.24, 2.2.16, 2.3.13 or 2.4.3 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.haproxy.org. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Name

• HAProxy

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.2.10
• 2.2.11
• 2.2.12
• 2.2.13
• 2.2.14
• 2.2.15
• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10
• 2.3.11
• 2.3.12
• 2.4.0
• 2.4.1
• 2.4.2
• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6
• 12.0.7
• 12.0.8
• 12.0.9
• 12.0.10
• 12.0.11
• 12.0.12
• 12.0.13
• 12.0.14
• 12.0.15
• 12.0.16
• 12.0.17
• 12.0.18
• 12.0.19
• 12.0.20
• 12.0.21
• 12.0.22
• 12.0.23

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion