Description
Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
References (4)
Core 4
Core References
Vendor Advisory x_refsource_confirm
https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962
Issue Tracking, Patch x_refsource_misc
https://github.com/apolloconfig/apollo/pull/5192
Patch x_refsource_misc
https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed
Release Notes x_refsource_misc
https://github.com/apolloconfig/apollo/releases/tag/v2.3.0
Scores
CVSS v3
4.3
EPSS
0.0010
EPSS Percentile
26.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-284
Status
published
Products (2)
apolloconfig/apollo
< 2.3.0
com.ctrip.framework.apollo/apollo
0 - 2.3.0Maven
Published
Aug 20, 2024
Tracked Since
Feb 18, 2026