Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-45232

security vulnerability on unauthorized access.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache APISIX Dashboard

  • 2.7 and 2.7.1affected
  • 2.8affected
  • 2.9affected
  • 2.10affected

References