CVE-2023-25569mediumCWE-352

CVE-2023-25569: falha de média gravidade em apolloconfig apollo

apollo-portal has potential CSRF issue

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar apollo+ Monitorar com.ctrip.framework.apollo:apollo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.7epss 0.4%
Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
apolloconfig · apollo
CVEs relacionadas — apolloconfig apollo

No mesmo produto, das mais perigosas para as menos.

CVE-2023-25570HIGHApollo has potential access control security issue in eurekaEPSS 0.8%CVE-2026-59954HIGHApollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingEPSS 0.6%CVE-2026-59955HIGHApollo ConfigService access key authentication bypass via raw config file appId parsingEPSS 0.6%CVE-2025-32781MEDIUMApollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseIdEPSS 0.4%CVE-2024-43397MEDIUMPotential unauthorized access issue in apollo-portalEPSS 0.3%