Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
Products
Apollo
- 2.3.0
Source
security-advisories@github.com
Tags
CVE-2024-43397 details
Published : Aug. 20, 2024, 3:15 p.m.
Last Modified : Aug. 20, 2024, 3:44 p.m.
Last Modified : Aug. 20, 2024, 3:44 p.m.
Description
Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
CVSS Score
| 1 | 2 | 3 | 4.3 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-284 | Improper Access Control | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Base Score
4.3
Exploitability Score
2.8
Impact Score
1.4
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
| URL | Source |
|---|---|
| https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed | security-advisories@github.com |
| https://github.com/apolloconfig/apollo/pull/5192 | security-advisories@github.com |
| https://github.com/apolloconfig/apollo/releases/tag/v2.3.0 | security-advisories@github.com |
| https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962 | security-advisories@github.com |
This website uses the NVD API, but is not approved or certified by it.