Vulnerability · Published Dec 27, 2021 · Assigned by apache

CVE-2021-45232security vulnerability on unauthorized access.

Critical 9.8

In plain English

A critical-severity missing authentication in Apache APISIX Dashboard from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 86.3% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)86.3%top 0.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache APISIX Dashboard	2.7 and 2.7.12.82.92.10

Weakness: CWE-306

References

https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5 x_refsource_MISC
[oss-security] 20211227 CVE-2021-45232: Apache APISIX Dashboard: security vulnerability on unauthorized access mailing-list, x_refsource_MLIST