CVE-2025-32781mediumCWE-639CWE-862

CVE-2025-32781: falha de média gravidade em apolloconfig apollo

Apollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId

Publicada em

Seguir esta CVE+ Monitorar apollo+ Monitorar com.ctrip.framework.apollo:apollo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
apolloconfig · apollo
CVEs relacionadas — apolloconfig apollo

No mesmo produto, das mais perigosas para as menos.

CVE-2023-25570HIGHApollo has potential access control security issue in eurekaEPSS 0.8%CVE-2026-59954HIGHApollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingEPSS 0.6%CVE-2026-59955HIGHApollo ConfigService access key authentication bypass via raw config file appId parsingEPSS 0.6%CVE-2023-25569MEDIUMapollo-portal has potential CSRF issueEPSS 0.4%CVE-2024-43397MEDIUMPotential unauthorized access issue in apollo-portalEPSS 0.3%