295 matches found
Apache Apisix Licensing Issue Vulnerability
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation in the United States. The software is based on OpenResty and etcd for dynamic routing and plug-in hot-loading, and is suitable for API management in microservice systems. an authorization issue...
CVE-2021-45232
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
CVE-2021-45232
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
CVE-2021-45232
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
Authentication flaw
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
CVE-2021-45232
In Apache APISIX Dashboard before version 2.10.1, the Manager API is implemented using two frameworks (gin and the droplet-based framework) with all APIs and authentication middleware built on droplet, while some APIs directly call gin interfaces, bypassing authentication. This leads to an authen...
CVE-2021-45232 security vulnerability on unauthorized access.
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...
Apache Apisix 访问控制错误漏洞
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation in the United States. The software is based on OpenResty and etcd for dynamic routing and plug-in hot-loading, and is suitable for API management in microservice systems. an authorization issue...
PT-2021-6081 · Apache · Apache Apisix Dashboard
Name of the Vulnerable Software and Affected Versions: Apache APISIX Dashboard versions prior to 2.10.1 Description: The issue is related to the Manager API in Apache APISIX Dashboard, which uses two frameworks, gin and droplet. While all APIs and authentication middleware are developed based on...
The vulnerability of the uri-block plugin for the Apache APISIX cloud API allows a hacker to bypass security restrictions.
The vulnerability of the uri-block plugin for the Apache APISIX cloud API is related to errors that occur when using the $requesturi variable. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...
Apache APISIX Command Injection Vulnerability
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in a microservice architecture. Apache APISIX has a security vulnerability that stems fr...
CVE-2021-43557
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...
CVE-2021-43557
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...
CVE-2021-43557
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...
Authentication flaw
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...
CVE-2021-43557 Path traversal in request_uri variable
The uri-block plugin in Apache APISIX before 2.10.2 uses $requesturi without verification. The $requesturi is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains...
CVE-2021-43557
CVE-2021-43557 affects Apache APISIX prior to 2.10.2. The issue is in the uri-block plugin, which uses $request_uri (the full original request URI without normalization) without verification, enabling construction of URIs that can bypass the block list (e.g., a block entry like ^/internal/ could ...
Apache Apisix 命令注入漏洞
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in a microservice architecture. Apache APISIX has a security vulnerability that stems fr...
PT-2021-5420 · Apache · Apache Apisix
Name of the Vulnerable Software and Affected Versions: Apache APISIX versions prior to 2.10.2 Description: The issue is related to the uri-block plugin in Apache APISIX, which uses the $request uri variable without proper verification. This variable contains the full original request URI without...
Apache APISIX Access Control Error Vulnerability
Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is implemented based on OpenResty and etcd, with dynamic routing and plugin hot-loading, suitable for API management under the microservices architecture. APISIX Dashboard has a security...