Vulnerability-Lookup

CVE-2020-15170 (GCVE-0-2020-15170)

Vulnerability from cvelistv5 – Published: 2020-09-10 18:40 – Updated: 2024-08-04 13:08

Title

Missing access control in apollo-adminservice

Summary

apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

Severity

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/ctripcorp/apollo/security/advi…	x_refsource_CONFIRM
https://github.com/ctripcorp/apollo/pull/3233/com…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
ctripcorp	apollo	Affected: <1.7.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apollo",
          "vendor": "ctripcorp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c1.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-10T18:40:14.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
        }
      ],
      "source": {
        "advisory": "GHSA-xpmx-h7xq-xffh",
        "discovery": "UNKNOWN"
      },
      "title": "Missing access control in apollo-adminservice",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15170",
          "STATE": "PUBLIC",
          "TITLE": "Missing access control in apollo-adminservice"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "apollo",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c1.7.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "ctripcorp"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20: Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh",
              "refsource": "CONFIRM",
              "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
            },
            {
              "name": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf",
              "refsource": "MISC",
              "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-xpmx-h7xq-xffh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15170",
    "datePublished": "2020-09-10T18:40:14.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-15170",
      "date": "2026-09-22",
      "epss": "0.01315",
      "percentile": "0.69505"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ctrip:apollo:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "FFAD5744-07B2-4E40-8CB5-FBC64D66E4A4",
                  "versionEndExcluding": "1.7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
        },
        {
          "lang": "es",
          "value": "apollo-adminservice versiones anteriores a 1.7.1, no implementa controles de acceso.\u0026#xa0;Si los usuarios exponen apollo-adminservice a Internet (lo cual no es recomendado), se presentan posibles problemas de seguridad, ya que apollo-adminservice est\u00e1 dise\u00f1ado para funcionar en intranet y no contiene control de acceso integrado.\u0026#xa0;Los hackers maliciosos pueden acceder a apis de apollo-adminservice directamente para acceder y editar las configuraciones de la aplicaci\u00f3n.\u0026#xa0;Para corregir el problema potencial sin actualizar, simplemente siga los consejos que no exponen apollo-adminservice a Internet"
        }
      ],
      "id": "CVE-2020-15170",
      "lastModified": "2024-11-21T05:04:59.790",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.8,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.0,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 2.2,
            "impactScore": 4.7,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.0,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 2.2,
            "impactScore": 4.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2020-09-10T19:15:13.583",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "NVD-CWE-Other"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:ctrip:apollo:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FFAD5744-07B2-4E40-8CB5-FBC64D66E4A4",
                    "versionEndExcluding": "1.7.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
          },
          {
            "lang": "es",
            "value": "apollo-adminservice versiones anteriores a 1.7.1, no implementa controles de acceso.\u0026#xa0;Si los usuarios exponen apollo-adminservice a Internet (lo cual no es recomendado), se presentan posibles problemas de seguridad, ya que apollo-adminservice est\u00e1 dise\u00f1ado para funcionar en intranet y no contiene control de acceso integrado.\u0026#xa0;Los hackers maliciosos pueden acceder a apis de apollo-adminservice directamente para acceder y editar las configuraciones de la aplicaci\u00f3n.\u0026#xa0;Para corregir el problema potencial sin actualizar, simplemente siga los consejos que no exponen apollo-adminservice a Internet"
          }
        ],
        "id": "CVE-2020-15170",
        "lastModified": "2024-11-21T05:04:59.790",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-09-10T19:15:13.583",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2020-15170

Vulnerability from fkie_nvd - Published: 2020-09-10 19:15 - Updated: 2026-06-17 02:56

Severity

7.0 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
7.0 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh	Third Party Advisory

Impacted products

	Vendor	Product	Version
	ctrip	apollo	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "apollo",
          "vendor": "ctripcorp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c1.7.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ctrip:apollo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFAD5744-07B2-4E40-8CB5-FBC64D66E4A4",
              "versionEndExcluding": "1.7.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
    },
    {
      "lang": "es",
      "value": "apollo-adminservice versiones anteriores a 1.7.1, no implementa controles de acceso.\u0026#xa0;Si los usuarios exponen apollo-adminservice a Internet (lo cual no es recomendado), se presentan posibles problemas de seguridad, ya que apollo-adminservice est\u00e1 dise\u00f1ado para funcionar en intranet y no contiene control de acceso integrado.\u0026#xa0;Los hackers maliciosos pueden acceder a apis de apollo-adminservice directamente para acceder y editar las configuraciones de la aplicaci\u00f3n.\u0026#xa0;Para corregir el problema potencial sin actualizar, simplemente siga los consejos que no exponen apollo-adminservice a Internet"
    }
  ],
  "id": "CVE-2020-15170",
  "lastModified": "2026-06-17T02:56:11.417",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-09-10T19:15:13.583",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-XPMX-H7XQ-XFFH

Vulnerability from github – Published: 2020-10-02 16:33 – Updated: 2021-11-19 15:30

Summary

Potential access control security issue in apollo-adminservice

Details

Impact

If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations.

Patches

Access control for admin service was added in #3233 and was released in v1.7.1.

Workarounds

To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

Credits

Lexu reported the issue and provided the required information to reproduce it.

References

Apollo Security Guidence

For more information

If you have any questions or comments about this advisory: * Open an issue * Email to one of the active project maintainers

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.ctrip.framework.apollo:apollo-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15170"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-10-02T16:32:24Z",
    "nvd_published_at": "2020-09-10T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nIf users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations.\n\n### Patches\nAccess control for admin service was added in #3233 and was released in [v1.7.1](https://github.com/ctripcorp/apollo/releases/tag/v1.7.1).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.\n\n### Credits\n[Lexu](https://github.com/lllllx) reported the issue and provided the required information to reproduce it.\n\n### References\n[Apollo Security Guidence](https://github.com/ctripcorp/apollo/wiki/Apollo%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97#71-%E5%AE%89%E5%85%A8%E7%9B%B8%E5%85%B3)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an [issue](https://github.com/ctripcorp/apollo/issues)\n* Email to one of the active [project maintainers](https://github.com/ctripcorp/apollo/graphs/contributors)",
  "id": "GHSA-xpmx-h7xq-xffh",
  "modified": "2021-11-19T15:30:46Z",
  "published": "2020-10-02T16:33:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15170"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ctripcorp/apollo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Potential access control security issue in apollo-adminservice"
}

GSD-2020-15170

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-15170

Aliases

CVE-2020-15170

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-15170",
    "description": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.",
    "id": "GSD-2020-15170"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-15170"
      ],
      "details": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.",
      "id": "GSD-2020-15170",
      "modified": "2023-12-13T01:21:43.746009Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-15170",
        "STATE": "PUBLIC",
        "TITLE": "Missing access control in apollo-adminservice"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "apollo",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c1.7.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "ctripcorp"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-20: Improper Input Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh",
            "refsource": "CONFIRM",
            "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
          },
          {
            "name": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf",
            "refsource": "MISC",
            "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-xpmx-h7xq-xffh",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,1.7.1)",
          "affected_versions": "All versions before 1.7.1",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-11-19",
          "description": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.",
          "fixed_versions": [
            "1.7.1"
          ],
          "identifier": "CVE-2020-15170",
          "identifiers": [
            "GHSA-xpmx-h7xq-xffh",
            "CVE-2020-15170"
          ],
          "not_impacted": "All versions starting from 1.7.1",
          "package_slug": "maven/com.ctrip.framework.apollo/apollo-core",
          "pubdate": "2020-10-02",
          "solution": "Upgrade to version 1.7.1 or above.",
          "title": "Potential access control security issue in apollo-adminservice",
          "urls": [
            "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15170",
            "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf",
            "https://github.com/advisories/GHSA-xpmx-h7xq-xffh"
          ],
          "uuid": "883ab966-daeb-4f02-a716-f24fb344548e"
        },
        {
          "affected_range": "\u003c1.7.1",
          "affected_versions": "All versions before 1.7.1",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-11-18",
          "description": "apollo-adminservice does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it does not have access control built-in. Malicious hackers may access apollo-adminservice apis directly to `access/edit` the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.",
          "fixed_versions": [
            "2.0.0"
          ],
          "identifier": "CVE-2020-15170",
          "identifiers": [
            "CVE-2020-15170",
            "GHSA-xpmx-h7xq-xffh"
          ],
          "not_impacted": "All versions starting from 1.7.1",
          "package_slug": "npm/ctrip-apollo",
          "pubdate": "2020-09-10",
          "solution": "Upgrade to version 2.0.0 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15170"
          ],
          "uuid": "c3296044-2833-4dc2-b3a9-a03bd26e9272"
        },
        {
          "affected_range": "(,1.7.1)",
          "affected_versions": "All versions before 1.7.1",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-11-18",
          "description": "apollo-adminservice does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it does not have access control built-in. Malicious hackers may access apollo-adminservice apis directly to `access/edit` the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.",
          "fixed_versions": [
            "1.7.1"
          ],
          "identifier": "CVE-2020-15170",
          "identifiers": [
            "CVE-2020-15170",
            "GHSA-xpmx-h7xq-xffh"
          ],
          "not_impacted": "All versions starting from 1.7.1",
          "package_slug": "nuget/Creekdream.Configuration.Apollo",
          "pubdate": "2020-09-10",
          "solution": "Upgrade to version 1.7.1 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15170"
          ],
          "uuid": "38eb76f6-eab4-4792-8a6a-5c47d41ab107"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ctrip:apollo:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.7.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15170"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn\u0027t have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application\u0027s configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf"
            },
            {
              "name": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 4.7
        }
      },
      "lastModifiedDate": "2021-11-18T17:49Z",
      "publishedDate": "2020-09-10T19:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-15170 (GCVE-0-2020-15170)

FKIE_CVE-2020-15170

GHSA-XPMX-H7XQ-XFFH

Impact

Patches

Workarounds

Credits

References

For more information

GSD-2020-15170

Tags

Sightings

Nomenclature

Related by attack behaviour