CVE-2020-13945

Exploit

EPSS 93.82%
Published 07.12.2020 20:15:12
Last modified 21.11.2024 05:02:12
Source security@apache.org
Teams watchlist Login
Open Login

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Affected products Warnungen 0 Metrics 3 CWE 0 References 5

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Apisix Version >= 1.2 <= 1.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	93.82%	0.999

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html

Third Party Advisory

Exploit

VDB Entry

https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E

Patch

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2020-13945

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-13945

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-13945

EUVD