CVE-2024-43397

Katalog CVE

CVSS 4.3 · Medium EPSS 0,35%

Kerentanan Improper Access Control pada apolloconfig apollo. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

Rincian

Terbit di NVD

20 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962 advisory vendor
• https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed patch
• https://github.com/apolloconfig/apollo/pull/5192 issue tracking · patch
• https://github.com/apolloconfig/apollo/releases/tag/v2.3.0 release notes