CVE-2020-13945: Medium severity apache apisix vulnerability

Q: What is CVE-2020-13945?

CVE-2020-13945 is a vulnerability in Apache APISIX that occurs when the user enables the Admin API and deletes the Admin API access IP restriction rules, allowing the default token to access APISIX management data.

Q: Which versions of Apache APISIX are affected by CVE-2020-13945?

Versions 1.2, 1.3, 1.4, and 1.5 of Apache APISIX are affected by CVE-2020-13945.

Q: What is the severity of CVE-2020-13945?

CVE-2020-13945 has a severity keyword of 'medium' and a severity value of 6.5.

Q: How can I fix CVE-2020-13945?

To fix CVE-2020-13945, you should implement proper IP restriction rules for the Admin API in Apache APISIX.

Q: Where can I find more information about CVE-2020-13945?

You can find more information about CVE-2020-13945 at the following references: [1] http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html [2] https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E

Published Dec 7, 2020

Updated

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Affected Software

1 affected component

Apache APISIX>=1.2<=1.5

Remediation

Patch Available

https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E

Event History

Dec 7, 2020

CVE Published

via MITRE·07:04 PM

Data Sourced

via MITRE·07:04 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-13945?

CVE-2020-13945 is a vulnerability in Apache APISIX that occurs when the user enables the Admin API and deletes the Admin API access IP restriction rules, allowing the default token to access APISIX management data.

Which versions of Apache APISIX are affected by CVE-2020-13945?