CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard API несанкционированное RCE Версия: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: root@kitploit: IP:PORT/apisix/admin/migrate/export...

CVE-2021-45232-RCE

Apache APISIX Dashboard RCE root@kitploit: использование: -h -u URL -p PORT -c CMD необязательные аргументы: -h, --help показать это справочное сообщение и выйти -u URL, --url URL целевой URL например: http://127.0.0.1:9000 -p PORT, --port PORT порт управления apisix по умолчанию: 9080 -c CMD,...

cve-2021-45232-exp

apisightdashboardrce Не будь злым...

CVE-2021-45232

CVE-2021-45232 CVE-2021-45232 POC 1、Сканирование уязвимости неавторизованного доступа к интерфейсу Apache APISIX Dashboard CVE-2021-45232 2、Сканирование паролей по умолчанию Apache APISIX Dashboard...

CVE-2021-45232

Уязвимость неавторизованного доступа Apache APISIX Dashboard CVE-2021-45232 Запрос FOFA title="Apache APISIX Dashboard" Затронутые версии Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export Рекомендации по устранению Обновите Apache APISIX Dashboard до последней...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner В более ранних версиях Apache APISIX Dashboard 2.10.1 существует уязвимость безопасности, связанная с несанкционированным доступом. Manager API использует два фреймворка и добавляет фреймворк droplet на основе фреймворка gin; все API и промежуточное ПО для...

CVE-2021-45232

Apache APISIX Dashboard 未授权访问接口 说明 该工具集成了 fofa 和 poc 一键检测功能，实现了一键从 fofa 爬取和一键检测（边爬边测） 使用方法 使用版本（Version）：python3 测试前要先更改自己的 fofatoken 值与更改变量 fofa 语法自定义测试范围 image-20220108153856024 python3 CVE-2021-45232.py 3 1 image-20220108153151252 image-20220108153428170 结果会保存在 resualt.txt 中...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE — многопоточное массовое обнаружение уязвимостей Запрос FOFA title="Apache APISIX Dashboard" Затронутые версии Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export Если это было полезно, пожалуйста, поставьте звёздочку,...

BIT-APISIX_DASHBOARD-2021-33190 Bypass network access control

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...

Apache APISIX Dashboard < 2.10.1 Authentication Bypass

The version of Apache APISIX Dashboard installed on the remote host is prior to 2.10.1. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated, remote attacker could exploit this to bypass authentication. Note that Nessus has not tested for these issues but has...

The vulnerability of the graphical interface of the Apache APISIX Dashboard cloud API gateway lies in the lack of authentication for a critical function, allowing attackers to bypass the authentication process.

The vulnerability of the graphical interface of the Apache APISIX Dashboard cloud API gateway is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process...

CVE-2021-45232

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...

CVE-2021-45232

In Apache APISIX Dashboard before version 2.10.1, the Manager API is implemented using two frameworks (gin and the droplet-based framework) with all APIs and authentication middleware built on droplet, while some APIs directly call gin interfaces, bypassing authentication. This leads to an authen...

CVE-2021-45232 security vulnerability on unauthorized access.

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin thus bypassing th...

Apache Apisix 访问控制错误漏洞

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation in the United States. The software is based on OpenResty and etcd for dynamic routing and plug-in hot-loading, and is suitable for API management in microservice systems. an authorization issue...

PT-2021-6081 · Apache · Apache Apisix Dashboard

Name of the Vulnerable Software and Affected Versions: Apache APISIX Dashboard versions prior to 2.10.1 Description: The issue is related to the Manager API in Apache APISIX Dashboard, which uses two frameworks, gin and droplet. While all APIs and authentication middleware are developed based on...

CVE-2021-33190

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...

CVE-2021-33190

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...

CVE-2021-33190 Bypass network access control

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...

CVE-2021-33190

CVE-2021-33190 – APISIX Dashboard 2.6 : The issue arises from using a risky IP acquisition function in the IP Allowed List, enabling bypass of network access restrictions when listen_host defaults to 0.0.0.0. This is fixed in APISIX Dashboard 2.6.1. Some sources also note an authentication bypass...