CVE-2020-13945

2020-12-0719:04:52

apache

www.cve.org

apache apisix

admin api

ip restrictions

cve-2020-13945

data management

EPSS

0.009

Percentile

83.0%

JSON

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

CNA Affected

[
  {
    "product": "Apache APISIX",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.2"
      },
      {
        "status": "affected",
        "version": "1.3"
      },
      {
        "status": "affected",
        "version": "1.4"
      },
      {
        "status": "affected",
        "version": "1.5"
      }
    ]
  }
]