Actions
Bug #16411
closed
Potential XSS in HAProxy Package
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:
Description
There is a potential reflected cross-site scripting vulnerability in the HAProxy package:
/usr/local/www/haproxy/haproxy_stats.php displays the value of the showsticktablecontent GET parameter without encoding.
Reported by Alex Williams of Pellera Technology via VulnCheck, CVE-2025-34172
While looking at that, I also found that the showstatresolvers code path references $sticktablename but it isn't relevant on that code path. The only possible item to display is globalresolvers, it doesn't need to use any user input for that action.
Updated by Jim Pingle about 2 months ago
- % Done changed from 0 to 100
New package build is now published and available for Plus 25.07.1, Plus 25.07, CE 2.8.1, and CE 2.8.0.
Actions