Vulnerability Description
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
CVSS Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apisix | >= 1.2, <= 1.5 |
References
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.ExploitThird Party AdvisoryVDB Entry
- https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bcMailing ListPatchVendor Advisory
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.ExploitThird Party AdvisoryVDB Entry
- https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bcMailing ListPatchVendor Advisory
FAQ
What is CVE-2020-13945?
CVE-2020-13945 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions...
How severe is CVE-2020-13945?
CVE-2020-13945 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-13945?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Apisix.