CVE-2016-2102: Medium severity aprox aproxengine vulnerability
HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network.
Other sources
It was found that HAProxy statistics are non-authenticated over network.
elements/haproxy/os-apply-config/etc/haproxy/haproxy.cfg:
listen haproxy.stats :{{#stats.port}}{{stats.port}}{{/stats.port}}{{^stats.port}}1993{{/stats.port}}
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2102?
CVE-2016-2102 is considered a high severity vulnerability due to non-authenticated access to HAProxy statistics over the network.
How do I fix CVE-2016-2102?
To fix CVE-2016-2102, restrict access to HAProxy statistics by implementing authentication and firewall rules.
What are the potential impacts of CVE-2016-2102?
The potential impacts of CVE-2016-2102 include unauthorized access to sensitive statistics, leading to possible exploitation of HAProxy configurations.
Which software is affected by CVE-2016-2102?
CVE-2016-2102 affects HAProxy instances that are misconfigured to allow non-authenticated access to their statistics.
Is CVE-2016-2102 exploited in the wild?
There have been reports of CVE-2016-2102 being exploited, making it critical to address this vulnerability promptly.