In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet
on the basis of framework gin
, all APIs and authentication middleware are developed based on framework droplet
, but some API directly use the interface of framework gin
thus bypassing the authentication.
[
{
"product": "Apache APISIX Dashboard",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "2.7 and 2.7.1"
},
{
"status": "affected",
"version": "2.8"
},
{
"status": "affected",
"version": "2.9"
},
{
"status": "affected",
"version": "2.10"
}
]
}
]