CVE-2020-13945observed exploitation

CVE-2020-13945: vulnerability in Apache APISIX

Published · Updated

Follow this CVE+ Monitor Apache APISIX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 74%
from disclosure to weapon1415 days
Published on NVDDec 7
1st PoC+1415d
metasploitDec 7
VulnCheck+2150d
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
Affected products
Apache Software Foundation · Apache APISIX
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache APISIX

In the same product, most dangerous first.

CVE-2022-24112CRITICALapisix/batch-requests plugin allows overwriting the X-REAL-IP headerEPSS 96.1%KEVCVE-2021-43557—Path traversal in request_uri variableEPSS 13.0%CVE-2022-29266—apisix/jwt-auth may leak secrets in error responseEPSS 8.1%CVE-2022-25757—Apache APISIX: the body_schema check in request-validation plugin can be bypassedEPSS 2.5%CVE-2024-32638MEDIUMApache APISIX: Forward-Auth Request SmugglingEPSS 1.1%CVE-2026-75005HIGHApache APISIX: Unauthenticated CPU-exhaustion DoSEPSS 0.7%