CVE-2020-13945
medium · 6.5A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
6.5
CVSS
73.0%
EPSS (exploit prob.)
99th
EPSS percentile
2020-12-07
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | apisix | >= 1.2, <= 1.5 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
- http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
- https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-13945