Vulnerability · Published Sep 10, 2020 · Assigned by GitHub_M

CVE-2020-15170Missing access control in apollo-adminservice

High 7.0

In plain English

A high-severity improper input validation in apollo from ctripcorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)1.3%top 29.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.ctrip.framework.apollo:apollo-core	1.7.1	GHSA-xpmx-h7xq-xffh

Affected products (as reported)

Vendor	Product	Versions
ctripcorp	apollo	<1.7.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh x_refsource_CONFIRM
https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf x_refsource_MISC