Vulnerability · Published Jun 8, 2021 · Assigned by apache

CVE-2021-33190Bypass network access control

Medium 5.3

In plain English

A medium-severity security flaw in Apache APISIX Dashboard from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)2.7%top 14.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache APISIX Dashboard	Apache APISIX Dashboard 2.6 2.6

Weakness: CWE-307

References

https://lists.apache.org/thread.html/re736aea55e8fd2478f0739c0c38a9375c4204fc1f0bd1ea687f57049%40%3Cdev.apisix.apache.org%3E x_refsource_MISC
[oss-security] 20210608 CVE-2021-33190: Apache APISIX Dashboard: Bypass network access control mailing-list, x_refsource_MLIST