CVE-2021-45232

Katalog CVE

CVSS 9.8 · Critical EPSS 86,3%

Kerentanan Missing Authentication for Critical Function pada apache apisix dashboard. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Rincian

Terbit di NVD

27 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

86,3% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2021/12/27/1 mailing list · advisory pihak ketiga