Lucene search

Veracode Vulnerability DatabaseVERACODE:48503

HistoryAug 21, 2024 - 8:08 a.m.

Authorization Bypass

2024-08-2108:08:11

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

authorization bypass

insufficient permission checks

synchronization configuration

modify namespace

software vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

21.3%

JSON

com.ctrip.framework.apollo:apollo is vulnerable to an Authorization Bypass. The vulnerability is due to insufficient permission checks in the synchronization configuration feature, allowing an attacker to modify a namespace without the necessary permissions.

References

github.com/advisories/GHSA-c6c3-h4f7-3962

github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed

github.com/apolloconfig/apollo/pull/5192

github.com/apolloconfig/apollo/releases/tag/v2.3.0

github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

21.3%

JSON

Related for VERACODE:48503